Moonwell pricing glitch lets liquidators seize millions in cbETH collateral

Incident overview: A configuration mistake in Moonwell's price feed caused the protocol to value cbETH at near a dollar rather than its market level, creating a short-lived but destructive pricing distortion. Liquidation algorithms reacted to the skewed inputs, allowing third parties to repay tiny debts and claim full collateral positions at fire-sale effective prices. In total, automated actors seized just over 1,096.317 cbETH, a position the risk firm later marked as equivalent to about $2.44M at expected market parity.

Mechanics and immediate effects: The bug stemmed from an update that used cbETH’s peg to ETH without coupling that ratio to ether’s dollar value, producing an artificial per-token quote near $1.12. Because automated liquidators operate on-chain and in milliseconds, they executed at the defective price, converting protocol collateral into realized losses while borrowers were left with outstanding deficits. Moonwell attempted rapid mitigation by cutting supply and borrowing caps, but a pending governance step plus a mandatory five-day timelock prevented an instant correction.

Wider context and consequences: The event produced roughly $1.78–$1.8M of bad debt on Moonwell’s books as markets and maintainers reconciled the mismatch. Debate flared about development practices after observers connected some code commits to an AI coding assistant, prompting fresh scrutiny of automated code contribution in security-sensitive DeFi components. The episode reinforces that oracles and protocol governance choices are primary attack surfaces; fixes will likely involve layered sanity checks, faster emergency controls, and greater transparency around code provenance.