{"post_stream":{"posts":[{"id":4765,"name":"Darren","username":"0xMims","avatar_template":"/user_avatar/forum.moonwell.fi/0xmims/{size}/1899_2.png","created_at":"2026-03-25T07:42:56.345Z","cooked":"\u003ch2\u003e\u003ca name=\"p-4765-summary-1\" class=\"anchor\" href=\"#p-4765-summary-1\" aria-label=\"Heading link\"\u003e\u003c/a\u003eSummary\u003c/h2\u003e\n\u003cp\u003eThe Moonwell contributors have identified a \u003cstrong\u003elive governance proposal on Moonriver (MIP-R39: Protocol Recovery – Admin Migration)\u003c/strong\u003e that was submitted \u003cstrong\u003ewithout a corresponding forum post or prior announcement\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eThe proposal has already reached quorum and is currently active.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"p-4765-request-for-proposer-engagement-2\" class=\"anchor\" href=\"#p-4765-request-for-proposer-engagement-2\" aria-label=\"Heading link\"\u003e\u003c/a\u003eRequest for Proposer Engagement\u003c/h2\u003e\n\u003cp\u003eAt this time, there is \u003cstrong\u003eno publicly available context, rationale, or discussion\u003c/strong\u003e associated with this proposal.\u003c/p\u003e\n\u003cp\u003eWe invite the proposer to:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eShare details on the intent of the proposal\u003c/li\u003e\n\u003cli\u003eProvide technical explanation of the changes\u003c/li\u003e\n\u003cli\u003eEngage with the community here in the forums\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eTransparent discussion is a core part of the Moonwell governance process.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"p-4765-guidance-to-the-community-3\" class=\"anchor\" href=\"#p-4765-guidance-to-the-community-3\" aria-label=\"Heading link\"\u003e\u003c/a\u003eGuidance to the Community\u003c/h2\u003e\n\u003cp\u003eUntil additional context is provided, we encourage community members to:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cimg src=\"https://emoji.discourse-cdn.com/twitter/warning.png?v=15\" title=\":warning:\" class=\"emoji\" alt=\":warning:\" loading=\"lazy\" width=\"20\" height=\"20\"\u003e Exercise caution when reviewing or voting on this proposal\u003c/li\u003e\n\u003cli\u003e\u003cimg src=\"https://emoji.discourse-cdn.com/twitter/red_exclamation_mark.png?v=15\" title=\":red_exclamation_mark:\" class=\"emoji\" alt=\":red_exclamation_mark:\" loading=\"lazy\" width=\"20\" height=\"20\"\u003e Avoid supporting proposals that lack sufficient transparency\u003c/li\u003e\n\u003cli\u003eWait for further clarification before taking action\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e","post_number":1,"post_type":1,"posts_count":4,"updated_at":"2026-03-25T13:02:04.651Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":220,"reads":23,"readers_count":22,"score":1139.6,"yours":false,"topic_id":2143,"topic_slug":"governance-notice-unverified-proposal-on-moonriver-mip-r39","display_username":"Darren","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":2,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":"Governance Lead","title_is_group":false,"bookmarked":false,"actions_summary":[{"id":2,"count":3}],"moderator":false,"admin":true,"staff":true,"user_id":437,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":false,"wiki":false,"mentioned_users":[],"post_url":"/t/governance-notice-unverified-proposal-on-moonriver-mip-r39/2143/1","reactions":[{"id":"heart","type":"emoji","count":3}],"current_user_reaction":null,"reaction_users_count":3,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":4767,"name":"blockful","username":"blockful","avatar_template":"/user_avatar/forum.moonwell.fi/blockful/{size}/4215_2.png","created_at":"2026-03-25T13:05:51.327Z","cooked":"\u003cp\u003eAfter seeing the abnormal proposal process we have analyzed the proposing address, calldata and all contracts involved. This proposal is clearly an attack, the proposal contract that will get ownership of the markets in case this proposal gets executed already includes the transactions necessary to exploit them.\u003c/p\u003e\n\u003cp\u003eThe voting power acquisition clearly shows that the attacker has a very clear (and very profitable) plan to execute here. Either governance or the guardian stops this, or over $1M will be lost from funds allocated to those markets.\u003c/p\u003e\n\u003cp\u003eBlockful is a governance security company, below is our report of the situation. We hope this is helpful and are available on telegram \u003cspan class=\"mention\"\u003e@zeugh\u003c/span\u003e or \u003cspan class=\"mention\"\u003e@alextnetto\u003c/span\u003e to support further.\u003c/p\u003e\n\u003ch1\u003e\u003ca name=\"p-4767-governance-attack-report-moonwell-proposal-74-1\" class=\"anchor\" href=\"#p-4767-governance-attack-report-moonwell-proposal-74-1\" aria-label=\"Heading link\"\u003e\u003c/a\u003eGovernance Attack Report: Moonwell Proposal \u003cspan class=\"hashtag-raw\"\u003e#74\u003c/span\u003e\u003c/h1\u003e\n\u003cp\u003e\u003cstrong\u003eDate:\u003c/strong\u003e March 25, 2026 | \u003cstrong\u003eNetwork:\u003c/strong\u003e Moonriver | \u003cstrong\u003eStatus:\u003c/strong\u003e Active, voting ends March 27 at 10:28 UTC\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"p-4767-summary-2\" class=\"anchor\" href=\"#p-4767-summary-2\" aria-label=\"Heading link\"\u003e\u003c/a\u003eSummary\u003c/h2\u003e\n\u003cp\u003eAn attacker bought 40.17M MFAM tokens on SolarBeam DEX for 1,600 MOVR (approximately $1,808 at current prices), created a fraudulent governance proposal, and voted it past quorum. The whole operation took 11 minutes.\u003c/p\u003e\n\u003cp\u003eThe proposal, titled “MIP-R39: Protocol Recovery - Admin Migration” (spoofing the legitimate proposal \u003cspan class=\"hashtag-raw\"\u003e#73\u003c/span\u003e), would transfer admin control of all 7 lending markets, the Comptroller, and the Oracle to the attacker’s contract. Once admin, the contract can drain all market funds.\u003c/p\u003e\n\u003cp\u003eCurrent vote tally: 41.57M FOR, 0 AGAINST. Quorum of 40M is met. There are approximately $1.08M in drainable funds across the protocol.\u003c/p\u003e\n\u003cp\u003eThe cancel function cannot stop this proposal. The only reliable defenses are defeating the vote or using the Break Glass Guardian, a 2-of-3 multisig that can bypass the timelock and neutralize the attack immediately.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"p-4767-attack-timeline-3\" class=\"anchor\" href=\"#p-4767-attack-timeline-3\" aria-label=\"Heading link\"\u003e\u003c/a\u003eAttack Timeline\u003c/h2\u003e\n\u003cp\u003eAll times UTC, March 24, 2026.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e10:16:30, Block 15,616,557: Funding\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eA hot wallet (\u003ccode\u003e0x88baeb35...37f8\u003c/code\u003e) sends 1,682 MOVR to the deployer (\u003ccode\u003e0xe62da344...736d\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eTransaction: \u003ccode\u003e0xccb0ce74...5700\u003c/code\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e10:23:48, Block 15,616,623: Contract deployment\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe deployer creates the attack contract at \u003ccode\u003e0x18275952...e1B4\u003c/code\u003e. It contains 16,521 bytes of purpose-built bytecode with hardcoded proposal calldata, drain logic, and cash-out functions.\u003c/p\u003e\n\u003cp\u003eTransaction: \u003ccode\u003e0xf95f93d5...c006\u003c/code\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e10:24:24, Block 15,616,629: Token acquisition and delegation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIn a single atomic transaction, the contract wraps 1,600 MOVR into WMOVR, swaps it on SolarBeam for 40,170,745.69 MFAM, and self-delegates all tokens. The pool went from 2,247 WMOVR / 96.76M MFAM to 3,847 WMOVR / 56.59M MFAM. No intervention window existed between token purchase and delegation.\u003c/p\u003e\n\u003cp\u003eTransaction: \u003ccode\u003e0xe03be433...e450\u003c/code\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e10:27:36, Block 15,616,661: Proposal creation\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eProposal \u003cspan class=\"hashtag-raw\"\u003e#74\u003c/span\u003e is created with 9 actions: \u003ccode\u003e_setPendingAdmin(attacker)\u003c/code\u003e on all 7 markets and the Comptroller, plus \u003ccode\u003esetAdmin(attacker)\u003c/code\u003e on the Oracle. The title “MIP-R39: Protocol Recovery - Admin Migration” was chosen to look like a continuation of the legitimate proposal \u003cspan class=\"hashtag-raw\"\u003e#73\u003c/span\u003e.\u003c/p\u003e\n\u003cp\u003eTransaction: \u003ccode\u003e0xd701a0d2...b066\u003c/code\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e10:28:36: Voting opens\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe 60-second voting delay elapses. Voting period is 3 days, ending March 27, 2026 at 10:28:36 UTC.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e10:32:00, Block 15,616,695: Attacker votes\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe contract calls \u003ccode\u003ecastVote(74, 0)\u003c/code\u003e where 0 means Yes. The attacker’s 40.17M MFAM exceeds quorum of 40M. An additional 1.4M MFAM was voted For by at least one other address, bringing the total to 41.57M. Zero opposition.\u003c/p\u003e\n\u003cp\u003eTransaction: \u003ccode\u003e0xe4c4a6f1...4ef\u003c/code\u003e\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"p-4767-voting-rights-4\" class=\"anchor\" href=\"#p-4767-voting-rights-4\" aria-label=\"Heading link\"\u003e\u003c/a\u003eVoting Rights\u003c/h2\u003e\n\u003cp\u003eThe governor contract sums voting power from three sources:\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eSource\u003c/th\u003e\n\u003cth\u003eContract\u003c/th\u003e\n\u003cth\u003eDescription\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eMFAM token\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0xBb8d88bc...a58F1\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eDirect token holdings, must be delegated. Total supply: 1B.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eDistributor\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x8568a675...cfab1\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eUnvested MFAM from the token sale vesting contract.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSafety Module (stkMFAM)\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0xcd76e63f...da3a\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003eStaked MFAM.\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003cp\u003eThe attacker’s votes came entirely from direct MFAM holdings. The proposal can still be affected by votes from any of these three sources. Vote encoding is reversed from standard GovernorBravo: 0 = Yes, 1 = No, 2 = Abstain. To defeat the proposal, Against votes must exceed For votes (quorum is already met).\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"p-4767-funds-at-risk-5\" class=\"anchor\" href=\"#p-4767-funds-at-risk-5\" aria-label=\"Heading link\"\u003e\u003c/a\u003eFunds at Risk\u003c/h2\u003e\n\u003cp\u003ePrices from CoinGecko, March 25, 2026 at 00:12 UTC.\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eMarket\u003c/th\u003e\n\u003cth\u003eAddress\u003c/th\u003e\n\u003cth\u003eCash\u003c/th\u003e\n\u003cth\u003eUSD Value\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003emUSDC\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0xd067...BFA8\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e269,337.65 USDC\u003c/td\u003e\n\u003ctd\u003e$269,308\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003emFRAX\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x93Ef...e9D\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e227,934.99 FRAX\u003c/td\u003e\n\u003ctd\u003e$225,996\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003emETH\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x6503...7aE\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e102.53 ETH\u003c/td\u003e\n\u003ctd\u003e$221,334\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003emMOVR\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x6a1A...8F1\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e123,547.58 MOVR\u003c/td\u003e\n\u003ctd\u003e$139,609\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003emUSDT\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x3691...BF21\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e123,796.42 USDT\u003c/td\u003e\n\u003ctd\u003e$123,741\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003emWBTC\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x6E74...4D90\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e1.01 WBTC\u003c/td\u003e\n\u003ctd\u003e$71,673\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003emxcKSM\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0xa0d1...8e0f\u003c/code\u003e\u003c/td\u003e\n\u003ctd\u003e6,315.26 xcKSM\u003c/td\u003e\n\u003ctd\u003e$28,229\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003cstrong\u003eTotal\u003c/strong\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cstrong\u003e$1,079,891\u003c/strong\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003cp\u003eAttack cost: 1,600 MOVR at $1.13 = $1,808. Profit: \u003cstrong\u003e597x\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eAdmin on all 7 markets confirmed as the Timelock. The most efficient drain path is a single \u003ccode\u003e_setComptroller()\u003c/code\u003e call on all markets to a malicious comptroller that allows unlimited uncollateralized borrowing.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"p-4767-response-plan-6\" class=\"anchor\" href=\"#p-4767-response-plan-6\" aria-label=\"Heading link\"\u003e\u003c/a\u003eResponse Plan\u003c/h2\u003e\n\u003ch3\u003e\u003ca name=\"p-4767-deadlines-7\" class=\"anchor\" href=\"#p-4767-deadlines-7\" aria-label=\"Heading link\"\u003e\u003c/a\u003eDeadlines\u003c/h3\u003e\n\u003cp\u003e\u003cstrong\u003eNow to March 27, 10:28 UTC:\u003c/strong\u003e Voting active, approximately 46 hours remain.\u003cbr\u003e\n\u003cstrong\u003eMarch 27, ~10:30 UTC:\u003c/strong\u003e If the proposal passes, the attacker can call \u003ccode\u003equeue()\u003c/code\u003e. This starts the 24-hour timelock.\u003cbr\u003e\n\u003cstrong\u003eMarch 28, ~10:30 UTC:\u003c/strong\u003e Earliest execution. The attacker can drain all funds.\u003c/p\u003e\n\u003cp\u003eThe Break Glass Guardian can act at any point, before, during, or after the vote.\u003c/p\u003e\n\u003ch3\u003e\u003ca name=\"p-4767-option-1-break-glass-guardian-safest-8\" class=\"anchor\" href=\"#p-4767-option-1-break-glass-guardian-safest-8\" aria-label=\"Heading link\"\u003e\u003c/a\u003eOption 1: Break Glass Guardian (safest)\u003c/h3\u003e\n\u003cp\u003eThe Break Glass Guardian is a 2-of-3 Gnosis Safe (\u003ccode\u003e0x5ded9d10...8db\u003c/code\u003e) that can bypass the timelock via \u003ccode\u003efastTrackExecuteTransaction\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eSigners (need 2 of 3):\u003c/strong\u003e\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eSigner\u003c/th\u003e\n\u003cth\u003eAddress\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eSigner 1\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x8c48d0dd4074f4839fcc20ea6715e2982001ed7a\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSigner 2\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0xcca82a517870b00fb31bc93a38025f042b5cc2ee\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSigner 3\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x2228375a0bd358fa2d04aab70cf057cff7c863c7\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eWhat to execute:\u003c/strong\u003e\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eCall \u003ccode\u003e__executeBreakGlassOnCompound\u003c/code\u003e with all 7 market addresses plus the Comptroller. This sets pending admin to the governance return address.\u003c/li\u003e\n\u003cli\u003eCall \u003ccode\u003e__executeBreakGlassOnSetAdmin\u003c/code\u003e with the Oracle address.\u003c/li\u003e\n\u003cli\u003eCall \u003ccode\u003e__executeCompoundAcceptAdminOnContract\u003c/code\u003e to accept admin on all contracts.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eOnce executed, the Timelock loses admin, and the attacker’s proposal becomes a no-op even if it passes and executes.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eOpen question for the Moonwell core team:\u003c/strong\u003e Does the team still have access to at least 2 of the 3 \u003ca href=\"https://moonriver.moonscan.io/address/0x5DeD9d1025a158554Ab19540Ae83182d890Bb8DB\" rel=\"noopener nofollow ugc\"\u003eBreak Glass Guardian\u003c/a\u003e signer keys? And separately, does the team control the \u003ca href=\"https://moonriver.moonscan.io/address/0x017eFfFd8ABea3B1891f81e7c0E5166458B3584D\" rel=\"noopener nofollow ugc\"\u003egovernance return address multisig\u003c/a\u003e (also a Gnosis Safe)? If admin transfers to the governance return address but nobody controls it, the protocol contracts become permanently locked.\u003c/p\u003e\n\u003ch3\u003e\u003ca name=\"p-4767-option-2-vote-against-9\" class=\"anchor\" href=\"#p-4767-option-2-vote-against-9\" aria-label=\"Heading link\"\u003e\u003c/a\u003eOption 2: Vote against\u003c/h3\u003e\n\u003cp\u003eRequires mobilizing more than 41.57M MFAM in No votes before March 27, 10:28 UTC. Voting power is snapshotted at the proposal’s start block (15,616,694), so buying more MFAM now would not increase anyone’s votes on this proposal. The real concern is the attacker or allies already holding delegated MFAM, Distributor allocations, or staked stkMFAM at that block that have not yet been voted.\u003c/p\u003e\n\u003cp\u003eThe Prop73 proposer (0xb5235bb9ec03353da455d742dd09cbc3817fe3fa) has at least 48.8M voting power at the snapshot block, entirely from staked MFAM in the Safety Module.\u003c/p\u003e\n\u003cp\u003eOne castVote(74, 1) call from that address defeats the proposal outright. No coordination needed — the VP is frozen, so the attacker can’t counter by buying more. The risk of other related wallets voting in favor of the attack remains, so more research is necessary before confirming the safety on this strategy.\u003c/p\u003e\n\u003ch3\u003e\u003ca name=\"p-4767-option-3-cancel-not-possible-10\" class=\"anchor\" href=\"#p-4767-option-3-cancel-not-possible-10\" aria-label=\"Heading link\"\u003e\u003c/a\u003eOption 3: Cancel (not possible)\u003c/h3\u003e\n\u003cp\u003eThe cancel function requires the proposer’s voting power to drop below 500,000 MFAM. The attacker holds 40.17M MFAM locked in the contract with no way to reduce it externally.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"p-4767-monitoring-11\" class=\"anchor\" href=\"#p-4767-monitoring-11\" aria-label=\"Heading link\"\u003e\u003c/a\u003eMonitoring\u003c/h2\u003e\n\u003cp\u003eThings to watch:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe attacker calling \u003ccode\u003equeue()\u003c/code\u003e after March 27, 10:28 UTC\u003c/li\u003e\n\u003cli\u003eOther wallets that held delegated MFAM, Distributor allocations, or stkMFAM at block 15,616,694 that have not yet voted (potential hidden voting power aligned with the attacker)\u003c/li\u003e\n\u003cli\u003eNew proposals from the attacker\u003c/li\u003e\n\u003cli\u003eBreak Glass Guardian transaction activity\u003c/li\u003e\n\u003cli\u003eNew votes cast on Proposal \u003cspan class=\"hashtag-raw\"\u003e#74\u003c/span\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca name=\"p-4767-key-addresses-12\" class=\"anchor\" href=\"#p-4767-key-addresses-12\" aria-label=\"Heading link\"\u003e\u003c/a\u003eKey Addresses\u003c/h2\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eEntity\u003c/th\u003e\n\u003cth\u003eAddress\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eGovernor\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x2BE2e230e89c59c8E20E633C524AD2De246e7370\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eTimelock (24h delay)\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x04e6322D196E0E4cCBb2610dd8B8f2871E160bd7\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eMFAM Token\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0xBb8d88bcD9749636BC4D2bE22aaC4Bb3B01A58F1\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBreak Glass Guardian\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x5ded9d1025a158554ab19540ae83182d890bb8db\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eGovernance Return Address\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x017efffd8abea3b1891f81e7c0e5166458b3584d\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eComptroller\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x0b7a0EAA884849c6Af7a129e899536dDDcA4905E\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eOracle\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x892bE716Dcf0A6199677F355f45ba8CC123BAF60\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eAttack Contract\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x18275952D3EA09D80DbE446D2cBA085E01e681B4\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eDeployer\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0xe62da344872b1a5644ee521001da6677a7ad736d\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eFunder\u003c/td\u003e\n\u003ctd\u003e\u003ccode\u003e0x88baeb35f73c72d0a4554d36851c1a76403937f8\u003c/code\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003ch2\u003e\u003ca name=\"p-4767-testing-13\" class=\"anchor\" href=\"#p-4767-testing-13\" aria-label=\"Heading link\"\u003e\u003c/a\u003eTesting\u003c/h2\u003e\n\u003cp\u003eWe are currently checking for all delegated voting power in the 3 voting power contracts, to estimate the safety of winning the vote vs the likelihood of hidden power held by the attacker.\u003cbr\u003e\nWe are also testing the “break glass defense” in a local fork to guarantee all works as intended.\u003c/p\u003e","post_number":2,"post_type":1,"posts_count":4,"updated_at":"2026-03-25T18:10:49.035Z","reply_count":1,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":154,"reads":20,"readers_count":19,"score":824.0,"yours":false,"topic_id":2143,"topic_slug":"governance-notice-unverified-proposal-on-moonriver-mip-r39","display_username":"blockful","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":3,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"link_counts":[{"url":"https://moonriver.moonscan.io/address/0x017eFfFd8ABea3B1891f81e7c0E5166458B3584D","internal":false,"reflection":false,"title":"Address: 0x017eFfFd...458B3584D | Moonriver","clicks":4},{"url":"https://moonriver.moonscan.io/address/0x5DeD9d1025a158554Ab19540Ae83182d890Bb8DB","internal":false,"reflection":false,"title":"Moonwell: Break Glass Guardian | Address: 0x5DeD9d10...d890Bb8DB | Moonriver","clicks":2}],"read":true,"user_title":"","bookmarked":false,"actions_summary":[{"id":2,"count":3}],"moderator":false,"admin":false,"staff":false,"user_id":921,"hidden":false,"trust_level":0,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":false,"wiki":false,"mentioned_users":[],"post_url":"/t/governance-notice-unverified-proposal-on-moonriver-mip-r39/2143/2","reactions":[{"id":"heart","type":"emoji","count":3}],"current_user_reaction":null,"reaction_users_count":3,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":4768,"name":"Fechuky","username":"Fechuky_25","avatar_template":"/user_avatar/forum.moonwell.fi/fechuky_25/{size}/514_2.png","created_at":"2026-03-25T23:49:39.077Z","cooked":"\u003cp\u003eThanks for sharing this detailed breakdown.\u003c/p\u003e\n\u003cp\u003eThis appears to be a clear attack on Moonwell Apollo governance, aiming to transfer protocol reserves to a specific individual or group by exploiting the low market cap and the current 40M MFAM quorum.\u003c/p\u003e\n\u003cp\u003eAlthough the protocol on Moonriver has been deprecated, one way to reduce the risk of similar attacks in the future would be to raise the quorum threshold, making this kind of manipulation significantly harder.\u003c/p\u003e\n\u003cp\u003eAll MFAM holders should vote against this proposal.\u003c/p\u003e\n\u003cp\u003eSmall note: I would only count FRAX, MOVR, and KSM as funds at risk, since the rest lost parity with their underlying assets after the Multichain hack.\u003c/p\u003e","post_number":3,"post_type":1,"posts_count":4,"updated_at":"2026-03-26T00:47:52.636Z","reply_count":0,"reply_to_post_number":2,"quote_count":0,"incoming_link_count":4,"reads":17,"readers_count":16,"score":68.4,"yours":false,"topic_id":2143,"topic_slug":"governance-notice-unverified-proposal-on-moonriver-mip-r39","display_username":"Fechuky","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":3,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":"","reply_to_user":{"id":921,"username":"blockful","name":"blockful","avatar_template":"/user_avatar/forum.moonwell.fi/blockful/{size}/4215_2.png"},"bookmarked":false,"actions_summary":[{"id":2,"count":1}],"moderator":false,"admin":false,"staff":false,"user_id":30,"hidden":false,"trust_level":3,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":false,"wiki":false,"mentioned_users":[],"post_url":"/t/governance-notice-unverified-proposal-on-moonriver-mip-r39/2143/3","reactions":[{"id":"heart","type":"emoji","count":1}],"current_user_reaction":null,"reaction_users_count":1,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":4774,"name":"Darren","username":"0xMims","avatar_template":"/user_avatar/forum.moonwell.fi/0xmims/{size}/1899_2.png","created_at":"2026-03-26T17:56:14.082Z","cooked":"\u003cp\u003eThe malicious proposal on Moonriver has now been canceled.\u003c/p\u003e\n\u003cp\u003eAs a reminder, if a proposer’s balance falls below the required proposal threshold at any point during the voting period, the proposal becomes eligible for permissionless cancellation by any participant.\u003c/p\u003e","post_number":4,"post_type":1,"posts_count":4,"updated_at":"2026-03-26T17:56:14.082Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":7,"reads":14,"readers_count":13,"score":112.8,"yours":false,"topic_id":2143,"topic_slug":"governance-notice-unverified-proposal-on-moonriver-mip-r39","display_username":"Darren","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":"Governance Lead","title_is_group":false,"bookmarked":false,"actions_summary":[{"id":2,"count":3}],"moderator":false,"admin":true,"staff":true,"user_id":437,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":false,"wiki":false,"mentioned_users":[],"post_url":"/t/governance-notice-unverified-proposal-on-moonriver-mip-r39/2143/4","reactions":[{"id":"heart","type":"emoji","count":3}],"current_user_reaction":null,"reaction_users_count":3,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null}],"stream":[4765,4767,4768,4774]},"timeline_lookup":[[1,217],[3,216]],"suggested_topics":[],"tags":[],"tags_descriptions":{},"fancy_title":"Governance Notice: Unverified Proposal on Moonriver (MIP-R39) :warning:","id":2143,"title":"Governance Notice: Unverified Proposal on Moonriver (MIP-R39) ⚠️","posts_count":4,"created_at":"2026-03-25T07:42:56.300Z","views":603,"reply_count":1,"like_count":10,"last_posted_at":"2026-03-26T17:56:14.082Z","visible":true,"closed":false,"archived":false,"has_summary":false,"archetype":"regular","slug":"governance-notice-unverified-proposal-on-moonriver-mip-r39","category_id":9,"word_count":1620,"deleted_at":null,"user_id":437,"featured_link":null,"pinned_globally":false,"pinned_at":null,"pinned_until":null,"image_url":null,"slow_mode_seconds":0,"draft":null,"draft_key":"topic_2143","draft_sequence":null,"unpinned":null,"pinned":false,"current_post_number":1,"highest_post_number":4,"deleted_by":null,"actions_summary":[{"id":4,"count":0,"hidden":false,"can_act":false},{"id":8,"count":0,"hidden":false,"can_act":false},{"id":10,"count":0,"hidden":false,"can_act":false},{"id":7,"count":0,"hidden":false,"can_act":false}],"chunk_size":20,"bookmarked":false,"topic_timer":null,"message_bus_last_id":0,"participant_count":3,"show_read_indicator":false,"thumbnails":null,"slow_mode_enabled_until":null,"tags_disable_ads":false,"related_topics":[{"fancy_title":":large_blue_circle: PGov Delegate Pitch","id":1232,"title":":large_blue_circle: PGov Delegate Pitch","slug":"pgov-delegate-pitch","posts_count":63,"reply_count":0,"highest_post_number":63,"image_url":null,"created_at":"2024-09-18T20:59:49.854Z","last_posted_at":"2026-10-22T16:11:18.790Z","bumped":true,"bumped_at":"2026-10-22T16:11:18.790Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🔵 PGov Delegate Pitch","tags":[],"tags_descriptions":{},"like_count":64,"views":1696,"category_id":17,"featured_link":null,"op_like_count":7,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":515,"username":"PGov","name":"PGov","avatar_template":"/user_avatar/forum.moonwell.fi/pgov/{size}/2239_2.png","trust_level":3}}]},{"fancy_title":"Monthly Governance Reports","id":787,"title":"Monthly Governance Reports","slug":"monthly-governance-reports","posts_count":32,"reply_count":0,"highest_post_number":33,"image_url":null,"created_at":"2024-02-12T23:00:08.922Z","last_posted_at":"2026-09-30T17:16:35.240Z","bumped":true,"bumped_at":"2026-09-30T17:16:35.240Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":21,"name":"boardroom","slug":"boardroom"}],"tags_descriptions":{},"like_count":50,"views":4593,"category_id":28,"featured_link":null,"op_like_count":6,"has_accepted_answer":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":291,"username":"Boardroom","name":"Boardroom","avatar_template":"/user_avatar/forum.moonwell.fi/boardroom/{size}/1282_2.png","moderator":true,"trust_level":4}}]},{"fancy_title":"Monthly Governance Calls","id":788,"title":"Monthly Governance Calls","slug":"monthly-governance-calls","posts_count":31,"reply_count":1,"highest_post_number":31,"image_url":null,"created_at":"2024-02-12T23:05:54.528Z","last_posted_at":"2026-09-24T17:50:05.688Z","bumped":true,"bumped_at":"2026-09-24T17:50:05.688Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":21,"name":"boardroom","slug":"boardroom"}],"tags_descriptions":{},"like_count":63,"views":2619,"category_id":28,"featured_link":null,"op_like_count":5,"has_accepted_answer":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user":{"id":291,"username":"Boardroom","name":"Boardroom","avatar_template":"/user_avatar/forum.moonwell.fi/boardroom/{size}/1282_2.png","moderator":true,"trust_level":4}},{"extras":null,"description":"Recent Poster","user":{"id":142,"username":"Curly","name":"Curly","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/c/91b2a8/{size}.png","trust_level":3}}]},{"fancy_title":"MIP-M23 and MIP-M24: Multichain Governor and WELL Migration","id":820,"title":"MIP-M23 and MIP-M24: Multichain Governor and WELL Migration","slug":"mip-m23-and-mip-m24-multichain-governor-and-well-migration","posts_count":11,"reply_count":6,"highest_post_number":11,"image_url":null,"created_at":"2024-03-23T02:08:44.761Z","last_posted_at":"2024-03-25T23:58:53.670Z","bumped":true,"bumped_at":"2024-03-25T23:58:53.670Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":13,"name":"moonbeam","slug":"moonbeam"},{"id":18,"name":"base","slug":"base"}],"tags_descriptions":{"moonbeam":""},"like_count":24,"views":963,"category_id":9,"featured_link":null,"op_like_count":4,"has_accepted_answer":false,"posters":[{"extras":"latest","description":"Original Poster, Most Recent Poster","user":{"id":269,"username":"elliot","name":"Elliot","avatar_template":"/user_avatar/forum.moonwell.fi/elliot/{size}/1120_2.png","trust_level":3}},{"extras":null,"description":"Frequent Poster","user":{"id":298,"username":"bumblebee04967","name":"bumblebee04967","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/b/3d9bf3/{size}.png","trust_level":2}},{"extras":null,"description":"Recent Poster","user":{"id":142,"username":"Curly","name":"Curly","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/c/91b2a8/{size}.png","trust_level":3}},{"extras":null,"description":"Recent Poster","user":{"id":4,"username":"Luke","name":"Luke Youngblood","avatar_template":"/user_avatar/forum.moonwell.fi/luke/{size}/2753_2.png","admin":true,"moderator":true,"trust_level":4}}]},{"fancy_title":"Increasing governance participation (and rewarding voters) part 2","id":1525,"title":"Increasing governance participation (and rewarding voters) part 2","slug":"increasing-governance-participation-and-rewarding-voters-part-2","posts_count":20,"reply_count":12,"highest_post_number":20,"image_url":"https://europe1.discourse-cdn.com/flex017/uploads/moonwell/optimized/2X/6/6d8c545e04699ff1aad8d05f45ab79e4e0a6da56_2_1024x748.png","created_at":"2025-01-27T15:56:10.326Z","last_posted_at":"2025-03-08T15:47:25.078Z","bumped":true,"bumped_at":"2025-03-08T15:47:25.078Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":14,"name":"discussion","slug":"discussion"},{"id":10,"name":"idea","slug":"idea"},{"id":6,"name":"proposal","slug":"proposal"}],"tags_descriptions":{},"like_count":71,"views":1406,"category_id":7,"featured_link":null,"op_like_count":19,"has_accepted_answer":false,"posters":[{"extras":null,"description":"Original Poster","user":{"id":4,"username":"Luke","name":"Luke Youngblood","avatar_template":"/user_avatar/forum.moonwell.fi/luke/{size}/2753_2.png","admin":true,"moderator":true,"trust_level":4}},{"extras":null,"description":"Frequent Poster","user":{"id":269,"username":"elliot","name":"Elliot","avatar_template":"/user_avatar/forum.moonwell.fi/elliot/{size}/1120_2.png","trust_level":3}},{"extras":null,"description":"Frequent Poster","user":{"id":653,"username":"Copernicvs","name":"Copernicvs","avatar_template":"/user_avatar/forum.moonwell.fi/copernicvs/{size}/2855_2.png","trust_level":1}},{"extras":null,"description":"Recent Poster","user":{"id":437,"username":"0xMims","name":"Darren","avatar_template":"/user_avatar/forum.moonwell.fi/0xmims/{size}/1899_2.png","admin":true,"trust_level":4}},{"extras":"latest","description":"Most Recent Poster","user":{"id":709,"username":"buisscrypto","name":"","avatar_template":"https://avatars.discourse-cdn.com/v4/letter/b/43a26b/{size}.png","trust_level":1}}]}],"summarizable":false,"has_cached_summary":false,"valid_reactions":["heart","+1","laughing","open_mouth","clap","confetti_ball","hugs"],"has_accepted_answer":false,"can_create_shared_issue":false,"shared_issue_visible":false,"discourse_zendesk_plugin_zendesk_id":null,"discourse_zendesk_plugin_zendesk_url":"https://your-url.zendesk.com/agent/tickets/","details":{"can_edit":false,"notification_level":1,"participants":[{"id":437,"username":"0xMims","name":"Darren","avatar_template":"/user_avatar/forum.moonwell.fi/0xmims/{size}/1899_2.png","post_count":2,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"admin":true,"trust_level":4},{"id":30,"username":"Fechuky_25","name":"Fechuky","avatar_template":"/user_avatar/forum.moonwell.fi/fechuky_25/{size}/514_2.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":3},{"id":921,"username":"blockful","name":"blockful","avatar_template":"/user_avatar/forum.moonwell.fi/blockful/{size}/4215_2.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":0}],"created_by":{"id":437,"username":"0xMims","name":"Darren","avatar_template":"/user_avatar/forum.moonwell.fi/0xmims/{size}/1899_2.png"},"last_poster":{"id":437,"username":"0xMims","name":"Darren","avatar_template":"/user_avatar/forum.moonwell.fi/0xmims/{size}/1899_2.png"},"links":[{"url":"https://moonriver.moonscan.io/address/0x017eFfFd8ABea3B1891f81e7c0E5166458B3584D","title":"Address: 0x017eFfFd...458B3584D | Moonriver","internal":false,"attachment":false,"reflection":false,"clicks":4,"user_id":921,"domain":"moonriver.moonscan.io","root_domain":"moonscan.io"},{"url":"https://moonriver.moonscan.io/address/0x5DeD9d1025a158554Ab19540Ae83182d890Bb8DB","title":"Moonwell: Break Glass Guardian | Address: 0x5DeD9d10...d890Bb8DB | Moonriver","internal":false,"attachment":false,"reflection":false,"clicks":2,"user_id":921,"domain":"moonriver.moonscan.io","root_domain":"moonscan.io"}]},"bookmarks":[]}