# Moonwell cbETH Oracle Exploit — February 2026

## 1. What Happened

- **Date:** February 15, 2026, at 6:01 PM UTC, when governance proposal MIP-X43 was executed on-chain. [1][2]
- **Chain:** Base. [1][2]
- **Amount lost:** $1,779,044.83 in bad debt across eleven assets. 1,096.317 cbETH was seized by liquidation bots. [1][2]
- **What was taken:** The largest losses were cbETH ($1,033,393), WETH ($478,998), and USDC ($232,584). Smaller amounts of EURC, cbBTC, cbXRP, DAI, USDS, AERO, MORPHO, and wstETH were also lost. [1][2]

## 2. Root Cause

The cbETH price oracle deployed by MIP-X43 was misconfigured: it fed only the cbETH/ETH exchange rate (approximately 1.12) and omitted the multiplication by ETH/USD. An asset worth roughly $2,200 was therefore reported on-chain at $1.12 — a 99.9% price collapse. The flawed configuration was introduced in a GitHub pull request (#578) co-authored by the AI coding assistant Claude Opus 4.6; neither the AI, human reviewers, nor the 99.1% of governance voters who approved the proposal caught the missing multiplication. [1][2][3]

This was not a smart-contract bug in the traditional sense. The oracle contract itself functioned as configured. The failure was a configuration error — a missing price-conversion step — combined with inadequate review and the absence of any automated price-sanity check that would have rejected a $1.12 valuation for a ~$2,200 asset. [1][2]

## 3. Pattern

**Oracle misconfiguration / missing price conversion.** The oracle consumed a ratio feed (asset/ETH) but treated it as a dollar-denominated price, omitting the required multiplication by ETH/USD. In pseudocode:

```
// Faulty configuration — what was deployed:
cbETH_USD_price = cbETH_ETH_rate   // ~1.12, treated as dollars

// Correct configuration — what was needed:
cbETH_USD_price = cbETH_ETH_rate * ETH_USD_price   // ~1.12 × ~1960 = ~$2,200
```

A single missing term turned a ~$2,200 collateral asset into a $1.12 asset from the protocol's perspective. Liquidation bots — operating correctly under protocol rules — seized collateral at the falsely low price, and borrowers extracted cbETH with trivial collateral. The five-day governance timelock prevented rapid correction. [1][2]

This was Moonwell's third oracle failure in four months, after mispriced volatile-token oracles (October 2025, $1.7M) and a wrsETH oracle feeding an absurd value after a Balancer exploit (November 2025, $3.7M). [1]

## 4. The Check That Would Have Caught It

**1. Price-sanity bounds in the oracle adapter.** Before deployment, the oracle configuration should have been validated against a reasonable price range for the asset. A check like `require(price >= minPrice && price <= maxPrice)` — with bounds derived from the asset's known market price — would have rejected $1.12 for a ~$2,200 asset. This check should run on every oracle update, not only at deployment. [1][2]

**2. Integration test comparing oracle output to a known reference price.** A deployment script or CI check that reads the configured oracle's reported price and asserts it is within, say, 10% of a secondary source (e.g., a Chainlink ETH/USD feed times the cbETH/ETH feed, or a CoinGecko API call) would have caught the discrepancy before the governance proposal reached a vote. The invariant: *the oracle must report a price within N% of the asset's independently observed market price.* [1][2]

## 5. Sources

1. rekt.news — "Moonwell — Rekt" — https://rekt.news/moonwell-rekt/ (primary technical analysis, all loss figures, historical context)
2. Moonwell Governance Forum — "MIP-X43 cbETH Oracle Incident Summary" by AnthiasLabs — https://forum.moonwell.fi/t/mip-x43-cbeth-oracle-incident-summary/2068 (official post-mortem, incident timeline, bad-debt breakdown)
3. GitHub — moonwell-fi/moonwell-contracts-v2 pull request #578 — https://github.com/moonwell-fi/moonwell-contracts-v2/pull/578 (the PR that introduced the misconfiguration; reviewer flagged a concern about cbETH price calculation that was not resolved)

*Note: Security-firm analyses from BlockSec, SlowMist, CertiK, Halborn, and Verichains specific to this incident could not be located via public search. QuillAudits published an analysis of a separate Moonwell incident (the mMAMO donation exploit of August 27, 2026) but not of the cbETH oracle incident.* [4]

4. QuillAudits — "Moonwell $8.7M mMAMO Exchange Rate Inflation Exploit" — https://www.quillaudits.com/blog/hack-analysis/moonwell-donation-exploit (separate incident, consulted and confirmed unrelated)