Archived tweet

Tweet thread by Blockful:

Moonwell on Moonriver is under an active governance attack. $1,808. That's what it cost to buy enough tokens to pass a proposal that can drain $1.08M in user funds. A 597x profit. Voting ends on March 27. There's still time to stop it. Tweeted at 3:29 PM · Mar 25, 2026 Our system flagged a high risk proposal. We got in contact with the core team to share our analysis, and make sure they are aware so we can mitigate the attack. The proposal transfers admin control of 7 lending markets, the Comptroller, and the Oracle to the attacker's contract. Tweeted at 19h We decompiled the unverified contract from Moonscan, and it really shows the attacker has the whole plan set and ready. The transactions to prepare, propose, vote and exploit are all included into a single piece of malicious code. Tweeted at 19h $1808 dollars and a single transaction. That was all it took to acquire enough voting power. The attacker deployed a contract that bought 40M MFAM on SolarBeam, self-delegated, created a proposal with "a legitimate title", and voted it past quorum 11 minutes. Start to finish. Tweeted at 19h With about 40h left for voting, other active wallets have enough power to defeat the attacker. Voting power was snapshotted at proposal creation, so buying MFAM now won't help. Another defense path is the "Break Glass Guardian", a 2-of-3 multisig that can bypass the timelock and Tweeted at 19h If you have delegated MFAM, staked stkMFAM, or had Distributor allocations at block 15,616,694, your votes count. Current tally: 43M FOR, 0 AGAINST. Moonwell team: the Break Glass Guardian keys need to move. The execution window opens March 28. Tweeted at 19h While defeating the vote is the path with least side effects, it is also the more risky one. Since the attacker can still have hidden wallets, ready to vote in the last block in case of opposition, we recommend the core team uses the Guardian to guarantee user funds are safe. Tweeted at 19h We published a governance attack report: timeline, on-chain transactions, funds at risk per market, and response plan. forum.moonwell.fi/t/governance-n … This is the kind of attack @anticapture is built to detect. Governance vulnerabilities are not edge cases, they are often the most Tweeted at 19h

Tweet #1

Image #1:

Image

Tweet #2

Image #1:

Image

Tweet #3

Image #1:

Image

Tweet #4

Image #1:

Image

Tweet #8

Links: