Moonwell's DeFi protocol lost $1.78 million due to a misconfigured oracle, linked to coding methods from Claude Opus 4.6.
The decentralized finance (DeFi) lending platform Moonwell has reported a significant loss of $1.78 million due to an oracle misconfiguration. The incident, linked to a coding method known as vibe coding using Claude Opus 4.6, unfolded on February 15 following the implementation of a governance proposal, MIP-X43, which enabled contract executions on the Base and Optimism markets.
A key error occurred when one of the oracles failed to accurately assess the price of Coinbase Wrapped ETH (cbETH). Instead of providing the correct price by multiplying the cbETH/ETH ratio with the ETH/USD value, the oracle erroneously transmitted only the token ratio. This resulted in cbETH being valued at approximately $1.12, far below its actual price of around $2,200.
Consequences for Users
This inaccurate pricing led to a series of liquidations, as trading bots sought out positions backed by cbETH. They were able to redeem roughly $1 of debt for 1,096.317 cbETH, effectively eliminating the collateral for numerous borrowers and leaving them with substantial debt. Additionally, some users were able to borrow cbETH at this undervalued price with minimal collateral.
“Upon discovering the issue, our risk manager @anthiasxyz swiftly reduced the cbETH borrowing limit to 0.01 to prevent further risks to the protocol,” Moonwell representatives explained.
Concerns Over Vibe Coding
Smart contract auditor Pashov pointed out that the coding errors were associated with commits made by Claude Opus 4.6. He raised concerns about the vulnerabilities in the code, suggesting that this incident could mark the first exploitation of Solidity code generated through vibe coding. In a tweet, he stated, “Claude Opus 4.6 wrote vulnerable code, leading to a smart contract exploit with $1.78 million loss.”
While the incident highlights potential risks associated with AI-assisted coding, Pashov emphasized that human oversight is crucial in the coding process, implying that the responsibility should not fall solely on the AI. Despite rising critiques regarding vibe coding, it continues to gain traction in the programming community.
In a related study conducted earlier this month, researchers identified 69 vulnerabilities across 15 applications developed using various popular coding tools, indicating ongoing security challenges in the field.
