Let me try to put this in clear language and tell everyone what happened. The API3 team approached me last week on Telegram while a lot of Moonwell contributors were having our annual onsite meetings and many of us had flown to California to meet in person for the first time this year.
They presented me with a Dune dashboard that shows lost liquidation opportunities on Base, which totaled around $640K, and evidence that the current OEV solution from Solidity Labs only captured ~$10. They also presented me with data showing the logic issue is that the OEV wrapper contract only captures a 99% tax on the gas fee and not the liquidation value. I thank them for presenting this data to us and ask if they can please give us a few weeks to remediate the logic issue.
The next day I spoke with the lead Solidity engineer who used to work for Solidity Labs earlier this year, but is now a fulltime contractor on Moonwell. They indicated this issue can easily be remediated and the OEV solution can be re-audited, however after the onsite meetings last week they had planned a short 2 week vacation months in advance and won’t return until August 4th.
I mentioned this to the API3 team, and expressed that Chainlink price feeds are the only feeds that are secure enough to protect the $40-50M TVL on OP mainnet and the 9 figures of TVL on Base. It’s not that API3 is insecure, they just don’t have as many data sources and don’t have a fully decentralized node operator network for each L2/L1 like Chainlink does.
I expressed my desire that they hold off on moving forward until after August 4th when our lead solidity engineer gets back from a well deserved, planned months in advance vacation, and remediates the issue and it gets audited, at which point the protocol can begin earning the revenue it will when the OEV solution is complete.
API3 ignored my requests and put this snapshot proposal up yesterday, while this engineer is attempting to enjoy time off for the first time this year. We have been working extremely hard on the Mamo agent and Moonwell improvements and every contributor has been ruthlessly focused on this.
Now I need to alert the community of things because API3 is not as secure as Chainlink, and it isn’t appropriate to replace Chainlink with API3 just because there is a logic issue that is resulting in less efficient OEV capture than might have been.
Here are the facts:
- Funds in the protocol on Base and OP mainnet are safe and still using Chainlink through an OEV wrapper. No funds are at risk. The only thing we are discussing here is how much extra value is captured from liquidations.
- Moonwell is the only protocol that has an OEV solution that uses an onchain auction where all OEV flows to the protocol and isn’t shared with any 3rd party on Base and OP mainnet.
- This solution allows Moonwell to continue using Chainlink price feeds, which have kept the protocol safe for 3.5 years from stale prices and have never had any downtime or data availability issues.
- This solution is only possible on fair ordering L2s built on OP stack
- Because this solution is not viable on Moonbeam, API3 bid for and won that opportunity
- Their solution requires a private auction and they keep half the profit, so they have a significant profit motive to implement that solution on OP mainnet and Base
- The logic issue in the current OEV solution created by Solidity Labs for Base and OP mainnet only captures a 99x MEV tax on the gas fee, not the liquidation value
- This can be easily remediated so that the 99x MEV tax will apply to the liquidation value, allowing it to scale appropriately and perform a complete onchain auction. For example if a liquidation value was $1,000, the liquidator might add $9 priority fee, which would result in a $899 cost=(9 + (99*9)) which means the liquidator still earns almost $100 but the protocol earns the rest, and doesn’t have to give 50% to API3
- This is also completely visible onchain, doesn’t require any infrastructure to be running except the Base sequencer itself, and lets Moonwell continue to use Chainlink price feeds, the industry standard for safety and security
I would recommend that people vote accordingly. On the one hand, Chainlink is safe, battle-tested, has operated for over 5 years, and is the gold standard used exclusively by the largest protocols in the space such as Aave and Morpho, on the other hand, API3, while innovative, has not yet proven it has the level of safety required to secure tens of millions of $ on OP mainnet or hundreds of millions of $ on Base.
When the lead Solidity engineer returns to the office on August 4th, I’ll ask if they can remediate the logic issue, the remediated OEV wrapper will get audited, and we can work as a DAO to upgrade the markets that use the current solution.
Thanks for considering my message when voting.