Moonwell encounters low-cost governance attack as attackers try to promote malicious governance proposals that threaten user funds

Moonwell, a decentralized lending agreement, is under a low-cost governance attack. An unidentified attacker spent approximately US$1,800 to purchase approximately 40 million MFAM tokens in an attempt to promote a malicious governance proposal to transfer control of the agreement's core contracts to contracts under its control. If the proposal is implemented, approximately US$1.08 million in user funds will be at risk. The operation took only about 11 minutes from purchasing the token to submitting the proposal and passing the statutory vote. The proposal involves seven lending markets, comptrollers and oracle machines. Once effective, attack contracts can directly withdraw agreement funds. Voting will continue until March 27. Although the initial proposal quickly reached the required number of votes, subsequent participation showed that a majority of voters opposed the measure. The final result still depends on the final voting statistics and any undeclared voting rights.