# Moonwell: misconfigured cbETH oracle triggers mass liquidations

Moonwell's cbETH oracle misconfigured to report cbETH/ETH ratio (~$1.12) instead of USD price, letting liquidators seize cbETH collateral for ~$1 debt and leaving $1.78M bad debt.

- Payout: Real-world hack
- Severity: critical
- Program: Moonwell
- Credited: DeFiHackLabs
- Disclosed: 2026-02-15
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-02/Moonwell_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260215-moonwell
- Tags: domain:web3 impact:funds-loss impact:mass-exploit kind:incident platform:defihacklabs sev:critical tech:evm technique:chained vuln:business-logic vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** Chainlink OEV oracle wrapper on Base lending market (mcbETH/mWETH)
**Root cause:** MIP-X43 oracle config used the raw cbETH/ETH exchange rate (~1.12) as the USD price instead of multiplying by the ETH/USD feed, reporting cbETH at ~$1.12 vs ~$2,200.
**Steps:**
1. Flash-borrow 129.9e15 WETH from Aerodrome CL pool `flash(...)`
2. In callback, approve WETH to mWETH and call `mWETH.liquidateBorrow(victim, amount, mcbETH)` — repaying tiny WETH debt to seize victim's cbETH collateral at the mispriced $1.12
3. Redeem seized mcbETH for cbETH via `mcbETH.redeem(balance)`
4. Swap cbETH to WETH on second Aerodrome CL pool `swap(this, true, cbETH.balanceOf(this), 4295128740, "")`
5. Repay flash loan `amount + amount0Delta` WETH, withdraw to ETH, forward to owner
**How found:** Post-mortem reveals the misconfiguration was introduced by governance proposal MIP-X43 enabling Chainlink OEV wrappers; monitoring detected the oracle discrepancy at 6:05 PM, 4 minutes after execution. Attackers/liquidators spotted the ~$1.12 cbETH price and raced to liquidate.
**Exploitation:** Attacker flash-borrowed ~0.13 WETH, liquidated an underwater victim position whose cbETH collateral was valued at ~$1.12, redeeming seized mcbETH for cbETH and swapping to WETH on Aerodrome to repay the flash loan and pocket the difference; broader incident saw liquidation bots and over-borrowers drain ~1096 cbETH collateral, leaving $1.78M protocol bad debt.
**Escalation:** Oracle mispricing applied protocol-wide across all cbETH-collateralized positions on Base and Optimism, so many liquidators and over-borrowers scaled the same flaw simultaneously; governance timelock (5-day) prevented immediate oracle fix, only supply/borrow caps could halt new activity.
**Insight:** When a governance proposal swaps oracle adapters, diff the new price derivation against the old one — a missing quote-currency multiplication (ratio feed used as USD price) silently misprices collateral by orders of magnitude and is instantly exploitable by liquidation bots before the timelock can revert it.