Audit log

Every state-changing event for Moonwell Lending: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-27 19:45:45Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,568,339

   sig

   2WWzBMRW47Md…mu3snjSFcopyexplorer ↗

   hash

   CbNkcGJ5jSit…b4uUdM72copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (9587 B) ▸

   {"actor":"system:backfill","investigation_id":"a9f1ce8e-0b15-4a1f-a9d0-6d8f5544dbf7","kind":"publish","page_slug":"moonwell-lending","published_at":"2026-05-27T19:45:45.832Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Moonwell Lending","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://nansen.ai/post/what-is-moonwell","type":"other","url":""},{"credibility":3,"name":"https://messari.io/project/moonwell","type":"other","url":""},{"credibility":3,"name":"https://news.bitcoin.com/lunar-labs-co-founder-luke-youngblood-talks-moonwell-artemis-and-over-collateralized-loans/","type":"other","url":""},{"credibility":3,"name":"https://www.coincarp.com/project/moonwell/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/moonwell","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/moonwell-bad-debt-recovery-plebiscite-draws-user-controversy","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/moonwells-bold-2-3m-plan-to-counter-frax-hack-debt-sparks-controversy/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@horatiolucas2/moonwell-finance-and-frax-finance-plan-to-appropriate-15m-users-assets-behind-a-controversial-dao-2912fcf62826","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/moonwell-bad-debt-recovery-plebiscite-draws-user-controversy","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/moonwells-bold-2-3m-plan-to-counter-frax-hack-debt-sparks-controversy/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@horatiolucas2/moonwell-finance-and-frax-finance-plan-to-appropriate-15m-users-assets-behind-a-controversial-dao-2912fcf62826","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinmarketcap.com/academy/article/2ff106ab-e90e-47b4-8403-627e3802508d","type":"other","url":""},{"credibility":3,"name":"https://coinedition.com/moonwell-defi-hit-by-320k-flash-loan-exploit-security-risks-highlighted/","type":"other","url":""},{"credibility":3,"name":"https://bitcoinethereumnews.com/tech/moonwell-defi-exploited-in-320k-flash-loan-attack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.mexc.com/en-PH/news/154021","type":"other","url":""},{"credibility":3,"name":"https://coinfomania.com/moonwell-oracle-exploit-base-optimism/","type":"other","url":""},{"credibility":3,"name":"https://99bitcoins.com/news/altcoins/moonwell-hack-1m-lost-after-chainlink-flaw-well-crypto-slumps-to-2025-lows/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=moonwell-oracle-malfunction","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-moonwell-hack-november-2025","type":"other","url":""},{"credibility":3,"name":"https://coinfomania.com/moonwell-oracle-exploit-base-optimism/","type":"other","url":""},{"credibility":3,"name":"https://en.coinotag.com/moonwells-1m-oracle-exploit-raises-defi-security-concerns-well-token-falls-12/","type":"other","url":""},{"credibility":3,"name":"https://99bitcoins.com/news/altcoins/moonwell-hack-1m-lost-after-chainlink-flaw-well-crypto-slumps-to-2025-lows/","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/chainlink-oracle-glitch-costs-moonwell-1m-as-defi-suffers-another-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/358374/oracle-error-leaves-defi-lender-moonwell-1-8-million-bad-debt","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/moonwell-exploit-cbeth-oracle-misprice-ai-commits-testing-audits","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/claude-moonwell-smart-contract-exploit/","type":"other","url":""},{"credibility":3,"name":"https://financefeeds.com/moonwell-exploited-for-1-78-million-after-cbeth-oracle-mispricing/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/moonwells-ai-coded-oracle-glitch-misprices-cbeth-at-1-drains-1-78m/","type":"other","url":""},{"credibility":3,"name":"https://btcusa.com/moonwell-hack-1-78m-exploit-linked-to-ai-generated-oracle-bug/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://crypto.news/moonwell-hit-by-governance-attack-1-08m-at-risk-for-1800-spend/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=moonwell-governance-attack","type":"other","url":""},{"credibility":3,"name":"https://www.dlnews.com/articles/defi/attacker-spends-less-two-grand-to-hold-crypto-project-hostage/","type":"other","url":""},{"credibility":3,"name":"https://www.kucoin.com/news/flash/defi-lending-protocol-moonwell-faces-governance-attack-on-moonriver","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/audits/moonwell/smart-contract-assessment-409b83","type":"other","url":""},{"credibility":3,"name":"https://code4rena.com/audits/2023-07-moonwell","type":"other","url":""},{"credibility":3,"name":"https://forum.moonwell.fi/t/migrate-moonwells-bug-bounty-program-provider-from-immunefi-to-code4rena/1386","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/chainlink-oracle-glitch-costs-moonwell-1m-as-defi-suffers-another-exploit/","type":"other","url":""},{"credibility":3,"name":"https://docs.moonwell.fi/moonwell/protocol-information/audits","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.moonwell.fi/moonwell","type":"other","url":""},{"credibility":3,"name":"https://messari.io/project/moonwell","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/moonwell","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/academy/moonwell-defi-guide","type":"other","url":""},{"credibility":3,"name":"https://x.com/QuillAudits_AI/status/1985654917898649840","type":"other","url":""}]}],"sources_used":[],"summary":"Moonwell is a decentralized, non-custodial lending and borrowing protocol deployed on Base, Optimism, Moonbeam, and Moonriver, operating as a fork of Compound v2. The protocol has suffered at least five distinct security incidents between 2022 and 2026, resulting in combined losses and bad debt exceeding $5 million, including repeated oracle failures, a flash loan exploit, a near-successful governance attack, and an AI-assisted smart contract misconfiguration. Despite multiple audits by Halborn and Code4rena, the pattern of recurring vulnerabilities and the removal of its Immunefi bug bounty program in early 2025 have raised significant security concerns.","timeline":[{"date":"2021-01-01","event":"Moonwell founded by Luke Youngblood under Lunar Labs; built as a Compound v2 fork targeting Moonbeam network","source":""},{"date":"2022-03-17","event":"Moonwell raises $10 million in Strategic funding round","source":""},{"date":"2022-08-02","event":"Nomad bridge exploited for $190.7 million; Moonwell's Moonbeam deployment suffers collateral losses and bad debt including approximately $2.9 million in Frax-related bad debt","source":""},{"date":"2023-07-24","event":"Code4rena competitive audit identifies 17 medium severity vulnerabilities and 56 low/informational issues; no critical or high severity findings","source":""},{"date":"2023-12-31","event":"Non-binding governance plebiscite passes 98% in favor of using Nomad collateral and protocol reserves to address Frax bad debt, drawing community controversy over asset appropriation","source":""},{"date":"2024-12-01","event":"Flash loan exploit on Optimism USDC market drains approximately $320,000 via a malicious mToken contract; stolen funds swapped to DAI","source":""},{"date":"2025-02-01","event":"Moonwell removes its Immunefi bug bounty program; proposes migration to Code4rena bug bounty platform","source":""},{"date":"2025-10-10","event":"Oracle-DEX price gap during market volatility allows exploitation of liquidation mechanisms on Base deployment; approximately $1.7 million lost","source":""},{"date":"2025-11-04","event":"Chainlink oracle malfunction misprices wrsETH at $5.8 billion; attacker drains approximately $1 million (295 ETH) within 30 seconds; $3.7 million in bad debt accrues; WELL token drops ~13.5%","source":""},{"date":"2026-02-15","event":"Governance proposal MIP-X43 deploys misconfigured Chainlink OEV oracle; cbETH mispriced at ~$1.12 instead of ~$2,200; $1.78 million in bad debt generated; AI-assisted code co-authored by Claude Opus 4.6 implicated","source":""},{"date":"2026-03-24","event":"Governance attack on Moonriver deployment: attacker spends $1,808 to acquire voting tokens, submits malicious proposal, reaches quorum in ~11 minutes; $1.08 million in assets placed at risk; community votes defeated the proposal","source":""},{"date":"2026-04-06","event":"DAO approves MIP-X49, implementing fixes to Wormhole V3 cross-chain integration following March 2026 upgrade (MIP-X48)","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ff0f0859-f2c6-403e-8a4e-a4adfa1afb93copy
2. #2rescoreby systemsystem

   2026-10-27 06:07:25Z
   Score: 28 → 45 (+17)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 45. Problems weighed by who is responsible: incidents the subject suffered −16, concerns that are not fraud −12.8, problems around the subject, caused by others −1.6; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,654

   sig

   4ivcpR83y6FY…iyPQ9JHNcopyexplorer ↗

   hash

   9ybfoKSP21bJ…iaCveCiWcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (648 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:25.533Z","decision":"rescore","investigation_id":"a9f1ce8e-0b15-4a1f-a9d0-6d8f5544dbf7","new_score":45,"page_slug":"moonwell-lending","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 45. Problems weighed by who is responsible: incidents the subject suffered −16, concerns that are not fraud −12.8, problems around the subject, caused by others −1.6; legitimacy credit long-running +10.","score_delta":17,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a2122ac2-72fa-4680-b8bc-af931180496ecopy
3. #3reviewby reviewerreviewer

   2026-11-02 04:47:51Z
   Score: 45 → 45 (no score change)
   The core incident narratives for November 2025 and February 2026 are broadly supported, and the governance-attack mechanics match reporting. The page is stale: it omits the 27 Aug 2026 MAMO exploit (about $8.7M) and the resulting Base borrowing freeze, and still says Moonwell 'continues to operate' as of early 2026. The Claude co-authorship claim is stated as fact where Decrypt reports it as unverified. The governance-attack date and the 66.7% vote figure were not supported. Only a sample of the 40+ sources was fetched.
   anchoranchored

   chain

   ●mainnet-betaslot 464,366,460

   sig

   4MLPhGA87SN2…4jddpeHUcopyexplorer ↗

   hash

   7pehG8eCmREV…DBmYyjFWcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1378 B) ▸

   {"actor":"reviewer","artifact_identity":"b1ec85bd2fb9e4c114d2b1d8421e25b0","decided_at":"2026-11-02T04:47:51.538Z","decision":"review","disputed_pct":0.25,"findings_hash":"ER8YvG6TbTDFE33BnShHRba32XATQKvB4swW6bR5CYid","investigation_id":"a9f1ce8e-0b15-4a1f-a9d0-6d8f5544dbf7","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":45,"omissions":{"material":1,"total":1},"page_content_hash":"2209cb564a72b727f981345628f368bdf3024f672a4b5c5328efb63f6db11ae5","page_slug":"moonwell-lending","prev_score":45,"reason":"The core incident narratives for November 2025 and February 2026 are broadly supported, and the governance-attack mechanics match reporting. The page is stale: it omits the 27 Aug 2026 MAMO exploit (about $8.7M) and the resulting Base borrowing freeze, and still says Moonwell 'continues to operate' as of early 2026. The Claude co-authorship claim is stated as fact where Decrypt reports it as unverified. The governance-attack date and the 66.7% vote figure were not supported. Only a sample of the 40+ sources was fetched.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 39ae09bb-4d63-42d9-9aef-3697959a4068copy
4. #4review reviseby judgejudge

   2026-11-02 04:47:51Z
   Score: 45 → 45 (no score change)
   The Nov 2025 and Feb 2026 incident figures check out against sources (claim_findings[2], [6]). The page is out of date, though. It leaves out the August 2026 MAMO exploit (about $8.7M) and the resulting borrowing freeze on Base, and it still says Moonwell 'continues to operate' as of early 2026 (claim_findings[0], omission_findings[0], subject_status). Other claims are weaker than stated. The Claude co-authorship is reported as unverified (claim_findings[3]), the Moonriver governance attack date and the 66.7% vote figure are unsupported (claim_findings[4], [5]), and the 'five incidents' tally omits the latest one (claim_findings[1]). The reviewer's confidence is moderate (0.6) and only a sample of sources was fetched, so the penalty sits in the middle of the band and the page is not denied.
   anchoranchored

   chain

   ●mainnet-betaslot 464,366,467

   sig

   MtDsi9RDqqYn…supnL3W6copyexplorer ↗

   hash

   Bx4AX3qeW9QZ…jxXUR2fTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1889 B) ▸

   {"actor":"judge","artifact_identity":"b1ec85bd2fb9e4c114d2b1d8421e25b0","band_override":null,"decided_at":"2026-11-02T04:47:51.538Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.25,"investigation_id":"a9f1ce8e-0b15-4a1f-a9d0-6d8f5544dbf7","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":45,"page_slug":"moonwell-lending","prev_score":45,"reason":"The Nov 2025 and Feb 2026 incident figures check out against sources (claim_findings[2], [6]). The page is out of date, though. It leaves out the August 2026 MAMO exploit (about $8.7M) and the resulting borrowing freeze on Base, and it still says Moonwell 'continues to operate' as of early 2026 (claim_findings[0], omission_findings[0], subject_status). Other claims are weaker than stated. The Claude co-authorship is reported as unverified (claim_findings[3]), the Moonriver governance attack date and the 66.7% vote figure are unsupported (claim_findings[4], [5]), and the 'five incidents' tally omits the latest one (claim_findings[1]). The reviewer's confidence is moderate (0.6) and only a sample of sources was fetched, so the penalty sits in the middle of the band and the page is not denied.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"minor","reason":"The review reports a critical omission (the 27 Aug 2026 MAMO market exploit of about $8.7M and the freeze on new Base borrowing) and finds that the page's 'continues to operate' status contradicts it. The claim percentage alone (25% unverifiable, 37.5% if the stale finding is counted) understates this, so the page is judged in the significant band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision eea46655-08b8-492e-a5a5-82c72a8b4a25copy
5. #5acceptby agent:avoid-moderatoranalyzer

   2026-11-03 23:04:23Z
   Score: 45 → 44 (-1)
   Yahoo Finance article dated 27 Aug 2026 reports Moonwell lost about $8.7M after MAMO price inflation; says no smart contract was broken. Matches the note and supports an incriminating label.
   Source:https://finance.yahoo.com/markets/crypto/articles/moonwell-lost-8-7-million-122819291.html

   Wayback:archived snapshot2026-09-21 12:52:03Z
   anchoranchored

   chain

   ●mainnet-betaslot 465,076,917

   sig

   28xMQhjxtErB…vfRUBNfucopyexplorer ↗

   hash

   BxVkBAsQGxdC…szp4oix7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (664 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T23:04:22.657Z","decision":"accept","investigation_id":"a9f1ce8e-0b15-4a1f-a9d0-6d8f5544dbf7","new_score":44,"page_slug":"moonwell-lending","prev_score":45,"reason":"Yahoo Finance article dated 27 Aug 2026 reports Moonwell lost about $8.7M after MAMO price inflation; says no smart contract was broken. Matches the note and supports an incriminating label.","score_delta":-1,"sequence_num":5,"submission_content_hash":"79909f5138ebabd9f3aec010b587f86975feb2a0f4560ca0a152f18ae32994f3","submission_id":"8e84ed4b-6108-48e9-a2d6-efa8c57f8100","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5afd699e-bc02-4f41-aa46-5c1254b11beacopy