Cowrie Research

moola-market-moo-oracle-manipulation-2022-10-18

14 min read

Moola Market MOO Oracle Manipulation (2022-10-18)

  • Name: Moola Market MOO oracle manipulation
  • Date: 2022-10-18
  • Protocol: Moola Market
  • Chain: Celo
  • Category: oracle manipulation / protocol-native collateral inflation / TWAP-manipulation / undercollateralized borrow
  • Loss: about 9.1M drained, including roughly 8.8M CELO, 765k cEUR, 644k cUSD, and 1.8M MOO; about 93.1% was later returned
  • Summary: The attacker used roughly 243,000 CELO of capital to attack Moola’s solvency model from both sides. First, they supplied about 60,000 CELO to Moola in order to borrow roughly 1.8 million MOO, the protocol’s own token, and use that MOO as collateral. Then they spent the remaining CELO aggressively buying MOO on Ubeswap, pushing the thin MOO/CELO market from about 0.02 CELO per MOO to about 0.73 CELO and dragging up the MOO TWAP oracle that Moola itself trusted. With the protocol now treating attacker-pumped MOO collateral as if it were durable value, the attacker borrowed out essentially all remaining CELO, cEUR, and cUSD liquidity. This was not just low liquidity on a small token; it was a self-referential collateral design failure where a protocol let its own thinly traded token become borrow power against the rest of the balance sheet.
  • Trigger / entry point:
    • Moola allowed MOO to be borrowed and then posted back as collateral.
    • Moola priced that collateral from a manipulable MOO TWAP sourced from Ubeswap.
    • The borrowable assets on Moola — CELO, cEUR, and cUSD — were deeper and more economically useful than the market depth backing MOO itself.
    • The attacker did not need a flash loan or a novel contract bug; the protocol exposed a manual leverage loop that let market impact on Ubeswap become protocol-recognized solvency.
  • Root cause:
    • Moola put its own low-liquidity token too close to the solvency core by letting MOO function as recognized collateral for deep-liquidity assets.
    • The protocol relied on a MOO TWAP that could still be dragged sharply upward because the underlying Ubeswap market was too shallow relative to the borrowing power available inside Moola.
    • The design was reflexive: CELO borrowed or retained inside the system could be used to buy more MOO, which increased the oracle mark on previously posted MOO collateral, which then unlocked more borrowing capacity.
    • The real failure was not merely oracle choice; it was that Moola let a thin, protocol-adjacent price become money-good collateral against the rest of the protocol’s reserves.
  • Exploit path:
    1. The attacker funded address 0x5dae2c3d5a9f35bfaf36a2e6edd07c477f57789e with 182,087.399 CELO in transaction 0x0c686ac4ecb6be587c045ddd07379b094ee6f0f01085743a3ebe62f60465c5ff, then routed capital through additional addresses before the drained funds converged at exploiter address 0x95b5579b323ddc6cd290bd4da6e56ba019588efc.
    2. Using roughly 243,000 CELO of working capital according to incident analyses, the attacker supplied about 60,000 CELO into Moola and borrowed about 1.8M MOO.
    3. The attacker posted the borrowed MOO back into Moola as collateral, creating a reflexive loop where Moola’s own token now supported borrowing capacity.
    4. With the remaining roughly 183,000 CELO, the attacker repeatedly bought MOO on the thin Ubeswap MOO/CELO market, pushing the price from about 0.02 CELO to about 0.73 CELO per MOO.
    5. Because Moola’s oracle path consumed that Ubeswap-based MOO TWAP, the protocol began treating the attacker’s MOO collateral as dramatically more valuable than the market could actually support.
    6. Against that printed collateral value, the attacker borrowed out the protocol’s remaining liquid assets, draining about 8.8M CELO, 765k cEUR, 644k cUSD, and 1.8M MOO in the process.
    7. Later the same day, after public negotiation with the team, the exploiter address returned most of the funds to Moola governance multisig 0xd7f77169d5e6a32c5044052f9a49eb94697b25ed, including 8,126,912.7222798 CELO in transaction 0xc3018d2e65bcd7c89d4fa2849017c6169c84c0934ca80c2c8dfd065da90d569d, plus separate MOO, cEUR, and cUSD transfers.
  • What the attacker needed to be true:
    • MOO liquidity on Ubeswap had to be thin enough that a few hundred thousand CELO could move the TWAP sharply.
    • Moola had to let MOO count as collateral for borrowing stronger assets.
    • Borrow caps and collateral policy had to be loose enough that manipulated MOO marks could unlock most of the protocol’s reserves.
    • The protocol had to trust the same ecosystem-local market the attacker was actively dominating.
  • Technical anatomy worth remembering:
    • This is a clean protocol-native token as collateral oracle-manipulation incident, not an LP-wrapper case like Cheese Bank and not a derivatives-PnL case like Mango.
    • It is also a useful reminder that TWAP is not a sufficient defense when the underlying market is too thin. Time-averaging a market one actor can dominate still gives you attacker-shaped collateral values.
    • The exploit was reflexive in two senses: Moola let its own token be used as collateral, and the attacker used capital that originated inside or around the protocol’s own market structure to keep levering the mark higher.
    • No exotic bug was required. The exploit path was mostly market structure plus collateral policy: buy the thin token, let the oracle accept the new price, then borrow better assets elsewhere in the same protocol.
    • The case is especially worth preserving because it shows how bear-market liquidity decay can turn a protocol-native asset from acceptable collateral on paper into cheaply printable solvency in practice.
  • Representative transactions and addresses:
    • Funding transaction: 0x0c686ac4ecb6be587c045ddd07379b094ee6f0f01085743a3ebe62f60465c5ff
    • Primary exploiter address flagged on CeloScan: 0x95b5579b323ddc6cd290bd4da6e56ba019588efc
    • Initial funded attacker address highlighted in incident analyses: 0x5dae2c3d5a9f35bfaf36a2e6edd07c477f57789e
    • Return transaction for the bulk CELO repayment: 0xc3018d2e65bcd7c89d4fa2849017c6169c84c0934ca80c2c8dfd065da90d569d
    • Moola governance multisig that received returned funds: 0xd7f77169d5e6a32c5044052f9a49eb94697b25ed
    • Manipulated market highlighted in incident reports: Ubeswap MOO/CELO
  • Response / mitigation:
    • Moola paused protocol activity after the exploit and publicly negotiated the return of funds.
    • More than 93% of drained assets were returned, leaving the exploiter with a bug-bounty-like remainder.
    • The team proposed removing MOO as a collateral asset, which gets closer to the real lesson than merely swapping in a different oracle adapter.
    • The deeper fix is collateral skepticism: protocol-native or thin governance tokens should face severe haircuts, tight caps, or outright exclusion from the solvency core when the protocol cannot guarantee durable external liquidity.

Pattern tags

  • oracle-manipulation
  • protocol-native-collateral-fragility
  • Reflexive borrow-and-repost loop: Moola let borrowed MOO be posted back as collateral while the same thin MOO/CELO market defined how much the rest of the protocol could be borrowed
  • TWAP over a dominatable local market: Ubeswap’s MOO/CELO path was not deep enough to justify the borrow power Moola granted against it
  • Protocol-native collateral admission plus loose reserve-outflow rights turned a local governance-token price into system-wide solvency authority

Three house-asset solvency promotions this incident collapsed

  1. Borrowable and repostable MOO inventory existed, and Ubeswap could still print a much higher MOO/CELO mark

    • Moola let the attacker supply about 60,000 CELO, borrow about 1.8M MOO, and repost that MOO as collateral.
    • The thin Ubeswap MOO/CELO venue was still shallow enough that the attacker’s remaining roughly 183,000 CELO could drag the market from about 0.02 CELO to about 0.73 CELO per MOO.

  2. Moola promoted that local MOO mark into canonical collateral truth

    • Moola’s oracle path consumed the Ubeswap-based MOO TWAP as if it were durable evidence of how much solvency the reposted house token represented.
    • The dangerous jump was not only MOO traded higher; it was Moola now recognizes this attacker-shaped house-token mark as valid borrowing power.

  3. Deeper reserve markets still honored that truth

    • Against the inflated MOO collateral value, Moola still let the attacker borrow out stronger inventory including CELO, cEUR, and cUSD.
    • The real loss therefore landed not on MOO holders alone, but on the protocol surfaces willing to release deeper reserves against that local governance-token story.

Why the exploit worked

  • The exploit only looked like a generic TWAP manipulation from far away. The sharper failure was reflexive collateral policy: Moola let its own thinly traded token act as recognized collateral for deeper reserves, and also let the attacker borrow MOO, repost it, and then use outside or retained CELO to push the same MOO/CELO market higher. Once those pieces were combined, the oracle did not just report a bad number; it validated a loop the protocol itself had already made possible.
  • Time averaging did not save Moola because the venue itself was too shallow relative to protocol value. QuillAudits and rekt both preserve the same core shape: with about 243,000 CELO of working capital, the attacker could move MOO from roughly 0.02 CELO to roughly 0.73 CELO. A TWAP over a market one actor can dominate is still an attacker-authored solvency mark if the protocol will honor it for nearly all reserve assets.
  • The collateral side and reserve side were badly mismatched. MOO had ecosystem-local, shallow support, while the assets borrowable against it — CELO, cEUR, and cUSD — were much stronger and more liquid. Moola therefore treated a fragile house-token quote as if it were good enough to underwrite withdrawals of the protocol’s best inventory.
  • Recursive structure amplified the attack. The attacker did not only buy spot MOO; they first supplied CELO, borrowed about 1.8M MOO, and posted that MOO back as collateral before driving the oracle mark higher. That made the incident a clean protocol-native solvency loop rather than a one-off external-market pump.
  • The durable lesson is that fresh price was never the real safety property. Even if the TWAP updated exactly as designed, Moola still failed because it granted too much credit to a protocol-adjacent asset whose executable exit depth was nowhere near the value it was allowed to unlock.

Detection and audit pivots

  • Separate house asset with a market price from house asset safe for solvency. If a protocol-native token mostly trades on one nearby DEX and lacks deep outside demand, ask why it is allowed to unlock the rest of the balance sheet at all.
  • Model recursive loops explicitly: can users supply blue-chip collateral, borrow the house token, repost it, and then use remaining capital to push the very price that sets their new borrowing power? Moola shows that this question matters more than whether the oracle math compiles.
  • Compare executable unwind depth on the house-token market with the maximum reserve outflow the protocol will honor against that token. If hundreds of thousands of CELO can move the mark enough to drain millions in CELO, cEUR, and cUSD, the protocol is recognizing far more solvency than the market can support.
  • Treat TWAP as a smoothing primitive, not a proof of independence or depth. Reviews should ask who provides the real liquidity, how concentrated that liquidity is, and whether the same capital source can both print the mark and cash it out elsewhere in the protocol.
  • Audit borrow caps, collateral factors, and collateral-type exclusions as part of oracle defense. If removing MOO as collateral is the credible post-incident fix, then the pre-incident problem was already collateral admission, not only oracle implementation details.

Failure-prevention checklist

  • Do not let protocol-native or foundation-adjacent governance tokens reach full collateral semantics merely because they have a TWAP feed. Require independent external depth, conservative caps, and a clear answer to who would actually buy size if liquidations started.
  • Break the reflexive loop explicitly: if users can borrow the house token, they should not also be able to repost that same token as collateral for stronger reserve assets without severe caps, quarantines, or outright exclusion.
  • Size collateral factors and market borrow caps from executable unwind depth on the house-token venue, not from nominal market cap, treasury narratives, or optimistic governance assumptions about community support.
  • Treat TWAP over one dominatable venue as weak evidence. A shallow DEX pair should not become system-wide solvency authority just because the manipulation needs several swaps instead of one.
  • Keep protocol-native collateral in staged activation. New or thin markets should begin with borrow disabled, low supply caps, or low collateral factors and only earn more trust after real outside liquidity survives stress.
  • Couple collateral admission and reserve-outflow rights. If a token can cheaply print collateral value, downstream markets for CELO, cEUR, and cUSD need separate damage limits so one local market cannot drain the whole protocol.
  • Add reflexivity-specific circuit breakers: if the house token price moves far faster than external majors or if one account’s collateral growth is mostly explained by recent buying on the token’s primary venue, freeze fresh borrowing against that collateral.
  • Prefer derecognition over oracle tinkering when the real problem is house-token fragility. If governance’s credible emergency fix is remove MOO as collateral, then that option should already exist in the normal risk playbook.

Audit prompts

  • Can a user supply blue-chip collateral, borrow the protocol’s own token, repost it, and then use remaining capital to move the venue that prices that reposted collateral?
  • What dollar value can the protocol lose if the house-token oracle moves 5x, 10x, or 30x before liquidations or caps react, and how does that compare with actual executable depth on the token’s primary market?
  • Does the protocol treat TWAP available as equivalent to market deep enough for collateral use, or is there a separate test for external demand, concentration, and unwind capacity?
  • If the protocol-native token were removed as collateral tomorrow, what other risk control would materially worsen? If the answer is not much, why was it ever allowed to underwrite deep reserve assets?
  • Which reserve assets can be drained against protocol-native collateral, and are those assets capped or isolated tightly enough that house-token reflexivity cannot threaten the whole balance sheet?
  • Is the house-token market actually independent of the protocol, or is the same treasury, community, or local DEX ecosystem effectively underwriting both the quoted price and the protocol that honors it?
  • What exact signal would tell operators that a price move is governance-token reflexivity rather than genuine market depth, and what automatic downgrade in borrowing authority follows from that signal?
  • During a downturn, when liquidity thins and treasury confidence falls, does collateral policy automatically get more conservative, or does the protocol keep honoring the same paper mark right up until exploiters test it?

Lessons that should already be standard

  • Protocol-native collateral is not just another listed asset. It is a reflexive claim on the same ecosystem that is now treating it as money-good solvency.
  • TWAP cannot rescue a market that nobody can exit at size. Time-averaging shallow community liquidity still produces shallow collateral truth.
  • Allowing users to borrow the house token and repost it as collateral is an explicit leverage loop, not a neutral product feature.
  • The right comparison is not is there a price feed? but can this token credibly absorb liquidation flow before deeper reserve assets leave the protocol?
  • When the emergency fix is remove the token as collateral, the original mistake was collateral admission, not merely oracle implementation.
  • House-token collateral should earn trust slowly and lose it quickly. If liquidity, external demand, or market independence deteriorate, borrow power should contract before an attacker proves it was fictitious.
  • Balance-sheet asymmetry is the real theft path: shallow local confidence in MOO was allowed to pull out much stronger CELO, cEUR, and cUSD reserves.

Why this incident matters

  • It is a clean preserved exemplar of direct thin-collateral repricing in a lending market: not LP-wrapper inflation, not vault-share mispricing, and not perp-PnL settlement, but a protocol-native token pumped until it became fake borrowing power.
  • It shows the specific danger of reflexive collateral design, where a protocol’s own token and its own nearby liquidity venues define how much of the rest of the protocol can be withdrawn.
  • It also helps round out the oracle-manipulation corpus by preserving the manual TWAP drag on a shallow governance-token market branch alongside Harvest’s vault-share path, Cheese Bank’s LP-wrapper path, and Mango’s derivatives-PnL path.

Internal linkages

Control surface

  • The leverage sat in MOO collateral admission, oracle venue choice, TWAP construction, borrow-cap policy, and Moola’s willingness to treat its own thin token as creditworthy collateral against the rest of the protocol.
  • Moola did not merely have a weak oracle. It had a reflexive solvency model: the protocol let attacker-shaped MOO pricing become withdrawable CELO, cEUR, and cUSD.

Sources

Last reviewed

  • 2026-07-31 UTC

Graph View

Backlinks