The recent MAMO incident has generated a lot of discussion around how Moonwell can continue improving its risk architecture as the protocol grows and supports a broader range of assets.
After reviewing the MAMO post-mortem, previous Moonwell incidents, the existing Asset Listing Framework, and approaches used elsewhere in DeFi lending, I wanted to put forward several ideas for community discussion.
This is not intended as direct criticism of Anthias Labs or existing contributors. Risk management in permissionless lending is extremely difficult, and no framework will anticipate every possible exploit. The goal is to take what we’ve learned and ask how Moonwell can make the next generation of its risk framework even stronger.
The MAMO incident is particularly useful because it demonstrated how multiple individually manageable risks can become much more dangerous when combined: thin executable liquidity, oracle-price movement, collateral accounting, and borrowing capacity.
The question I believe should increasingly sit at the center of Moonwell’s risk analysis is:
How much capital would an adversary need to create or manipulate collateral value, compared with how much liquid value they could extract from Moonwell as a result?
If the second number can materially exceed the first, the protocol potentially has an economic vulnerability even when individual parameters are functioning as designed.
1. Introduce a Collateral Graduation Framework
Rather than treating Core Market collateral eligibility as primarily a listing decision, I think collateral could progressively earn greater borrowing capacity through demonstrated performance.
A possible framework:
Tier 0 — Observation / Supply Only
New or unusual assets could initially have a 0% collateral factor while Moonwell observes liquidity, oracle behavior and market development.
Tier 1 — Isolated
Newer, thinner, more volatile or structurally complex assets could begin in Moonwell’s existing isolated-market architecture with conservative parameters. This allows real-world usage without exposing the entire Core lending pool.
Tier 2 — Limited Core
Assets could graduate into Core after demonstrating sustained executable liquidity, reliable oracle performance, healthy distribution and predictable liquidation behavior. Initial Core caps and collateral factors would remain conservative.
Tier 3 — Mature Core
Larger exposure would be available only after an asset has demonstrated resilience over time and through different market conditions.
The underlying principle would be:
Core Market exposure should be earned through measurable performance rather than assumed at listing.
Importantly, graduation should also work in reverse. Deteriorating liquidity, oracle quality or market structure should be capable of moving an asset back toward tighter caps, lower collateral factors or isolation.
2. Stress-Test Manipulation Cost vs. Extractable Value
I would like to see Moonwell’s risk analysis explicitly model markets from an attacker’s perspective.
For proposed collateral, Core graduation and major parameter increases, analysis could estimate the capital required to manipulate the asset under scenarios such as +25%, +50%, +100% and extreme-tail movements.
That could then be compared against the additional borrowing power and liquid value available for extraction from Moonwell.
The analysis should account for more than headline market capitalization or aggregate TVL. It should consider:
- Executable DEX/CEX depth and slippage
- Concentrated liquidity ranges
- Flash liquidity
- Holder concentration
- Cross-chain liquidity fragmentation
- Oracle update/deviation characteristics
- Liquidation depth
- Borrowed assets potentially being recycled into further manipulation
I believe supply and borrow caps should ultimately scale with real executable liquidity and adversarial manipulation cost—not simply market cap or demand for the asset.
3. Add Collateral-Accounting Attack Testing
The MAMO post-mortem also demonstrates that price manipulation cannot be considered independently from collateral accounting.
Future assessments could explicitly test:
- Direct underlying-token transfers
- Donation attacks
- mToken/share exchange-rate manipulation
- Supply-cap bypasses
- Unexpected ERC-20 behavior
- Share-price/accounting inflation
- Oracle × exchange-rate interactions
- Flash-loan combinations
- Multi-step attacks combining several otherwise acceptable mechanisms
A supply cap should ideally constrain the effective economic exposure created by collateral, rather than only tokens entering through the expected mint/supply pathway.
4. Continuous Monitoring + Defensive Circuit Breakers
Passing an initial listing assessment should not mean an asset remains equally safe indefinitely.
Moonwell could define objective thresholds that progressively trigger:
Warning → Supply/Borrow Cap Reduction → Collateral Factor Reduction → Borrowing Restriction → Temporary Collateral Freeze
Potential triggers could include abnormal oracle/DEX divergence, rapid exchange-rate changes, deteriorating executable liquidity, unusual direct transfers into market contracts, extreme utilization, increasing holder concentration or a significant decline in estimated manipulation cost.
The goal would not necessarily be full automation of every governance decision. Rather, the protocol could have predetermined defensive responses available when conditions move outside accepted risk tolerances.
5. Independent Secondary Risk Review
Another idea worth discussing is whether particularly important risk decisions should receive a second independent assessment.
This would complement Anthias Labs—not replace them.
A second opinion could be required only for higher-risk changes such as:
- New Core collateral
- Graduation from isolated → Core
- Large supply/borrow-cap increases
- Major collateral-factor increases
- New oracle architectures
- Tokenized stocks/RWAs
- Structurally unusual collateral
- Post-incident architecture reviews
No single risk provider or methodology will identify every possible attack path. Independent analysis provides another opportunity to identify assumptions or attack combinations that one model may overlook.
6. Additional Standards for Tokenized Equities and RWAs
I think this becomes especially important as Moonwell expands into tokenized real-world assets.
A tokenized stock can represent a highly liquid underlying security while its onchain wrapper remains comparatively illiquid.
Risk assessments should therefore distinguish between underlying-market liquidity and actual onchain liquidation liquidity while considering market-hours gaps, weekend trading, oracle availability, redemption/NAV divergence, issuer/custodian risk and wrapper concentration.
My preference would be an isolated-first approach for these assets, followed by graduation based on actual onchain performance.
7. Periodic Core-Market Reassessment
Core collateral shouldn’t necessarily retain the same risk classification indefinitely.
Periodic reviews could reassess executable liquidity, oracle performance, holder concentration, liquidation behavior and manipulation economics.
Significant cap or collateral-factor increases could also require an updated stress test rather than relying solely on the original onboarding analysis.
Following an incident, the predicted assumptions from previous risk assessments could then be compared against what actually occurred. This creates a feedback loop where Moonwell’s models continuously improve from real-world events.
8. Explore Integrated DeFi Insurance/Coverage
I also think Moonwell should explore partnerships with reputable decentralized insurance/coverage protocols.
Rather than Moonwell becoming the insurer, the interface could potentially offer users an optional “Protect this position” pathway when supplying assets.
Depending on available coverage, users could choose protection against risks such as smart-contract exploits, oracle failures, economic attacks or lending-market insolvency.
Premiums, exclusions, claims procedures and the fact that coverage is provided by an independent third party would need to be extremely clear.
This could create a layered protection model:
Protocol risk controls → reserves/Safety Module → optional third-party user coverage
Insurance obviously doesn’t replace strong protocol security, but giving users direct access to additional protection could become a meaningful competitive feature for Moonwell.
Where I’d Like Community Feedback
I’m particularly interested in feedback from Anthias, Moonwell contributors, delegates and community members on several questions:
- Would an isolated → limited Core → mature Core graduation model be practical within Moonwell’s current architecture?
- Could attacker capital required vs. maximum extractable borrowing value become a formal risk metric?
- What additional safeguards can prevent direct-transfer/donation-style exchange-rate manipulation in Compound-style markets?
- Which risk conditions could realistically trigger automated or Guardian-based defensive actions?
- Would an independent secondary review materially improve security for higher-risk listings and parameter changes?
- Should tokenized equities/RWAs have their own stricter onboarding standard?
- Would the community value optional third-party insurance/coverage directly accessible through the Moonwell interface?
Closing Thoughts
I don’t think the lesson from MAMO should be that Moonwell needs to stop supporting emerging assets.
The better lesson may be that the amount of systemic borrowing power granted to an asset should grow alongside demonstrated economic resilience.
Moonwell already has many of the pieces necessary to implement this: Core Markets, Isolated Markets, Cap Guardian functionality, professional risk analysis and decentralized governance.
The opportunity now is to connect those pieces into a more formal lifecycle:
Observe → Isolate → Stress Test → Graduate → Monitor → Reassess
If implemented correctly, the objective would be straightforward:
Make manipulation economically irrational, constrain unexpected technical behavior, and prevent the failure of any single collateral asset from creating disproportionate losses across Moonwell Core Markets.
I’d appreciate thoughts and additional ideas from the community before attempting to turn any of this into a formal Snapshot/MIP.