PACTAby Fractal Neurons
Pacta / Protocols / Moonwell (Base)
Base Lending & Borrowing

Moonwell (Base): control-plane safety record

1 indexed control-plane surface for Moonwell (Base), with its controller and timelock state pinned to a canonical Base block over archive JSON-RPC (not EAS-attested; documentation parameters are linked, not compared). Contract: 0xfBb21d0380beE3312B33c4353c8936a0F13EF26C.

Check it live (free)

The pre-flight API re-reads the controller, proxy and capabilities of a contract at the latest block. No key, no wallet.

Live pre-flight check
curl -s "https://pacta-x402.pacta.workers.dev/v1/check/preflight?chain=base&address=0xfBb21d0380beE3312B33c4353c8936a0F13EF26C"

MCP: https://pacta-x402.pacta.workers.dev/mcp · tool pacta_check_preflight.

Provenance

RPC-pinned record: read over public JSON-RPC at the Base block shown below and independently re-read at the same block by a second Pacta seat. It is not EAS-attested: no sprint number, no summary document and no Base EAS UID. Status RPC-observed baseline: the on-chain control plane is pinned at block height; whether it matches the protocol's documented parameters is not assessed here (the documentation is linked for reference). Machine-readable: /api/v1/rpc-pinned.json. The Base-EAS-attested Sprint records are in /api/v1/index.json.

MoonwellUnitroller_Base · Admin Contract Owned by a 3-of-5 Safe

Status
RPC-observed baseline
Target
MoonwellUnitroller_Base 0xfBb2…F26C
Pinned block
Base #57,421,449 · RPC-pinned, not EAS-attested
Block hash
0x36147f7f…ba35b0
Controller
Contract 0x8b62…7d51 · owned by 3-of-5 Safe 0x4463…779E

Observed on-chain. MoonwellUnitroller_Base (0xfBb21d0380beE3312B33c4353c8936a0F13EF26C) verified on Base Mainnet at canonical block #57,421,449 (1,412 bytes runtime code). EIP-1967 implementation and admin storage slots are both zero (non-EIP-1967 contract). Direct admin() returns contract 0x8b621804a7637b781e2BbD58e256a591F2dF7d51 (8,658 bytes runtime code; not a Safe: getThreshold() reverts). That contract's owner() is 0x446342AF4F3bCD374276891C6bb3411bf2F8779E, verified via getThreshold() and getOwners() as a 3-of-5 Safe multisig.

Documentation (linked, not compared). Moonwell (Base) documentation is linked for reference (https://docs.moonwell.fi/; governance: https://forum.moonwell.fi/). This RPC-pinned record does not compare documentation parameters with the on-chain state.

Reproduce on any archive node
cast call 0xfBb21d0380beE3312B33c4353c8936a0F13EF26C \
  "admin()" \
  --block 57421449 --rpc-url "$BASE_RPC_URL"
cast call 0x8b621804a7637b781e2BbD58e256a591F2dF7d51 "owner()(address)" --block 57421449 --rpc-url "$BASE_RPC_URL"
cast call 0x446342AF4F3bCD374276891C6bb3411bf2F8779E "getThreshold()(uint256)" --block 57421449 --rpc-url "$BASE_RPC_URL"
cast call 0x446342AF4F3bCD374276891C6bb3411bf2F8779E "getOwners()(address[])" --block 57421449 --rpc-url "$BASE_RPC_URL"
cast block 57421449 --field hash --rpc-url "$BASE_RPC_URL"
# expect 0x36147f7f0b6d2a0a94975e98b14c979034930dbe6f9905a5b0bcb2ab45ba35b0
For issuers

Issuing Moonwell (Base)? Reconcile & Anchor 24h Institutional Clearance

Reconcile documentation drift, verify multisig and timelock control planes across archive RPCs, prepare an upstream docs reconciliation PR, and anchor a Base EAS Aligned Attestation + Curator Diligence Dossier within 24 hours.

Read-only on-chain analysis. Not investment advice. Exploit-sensitive vulnerabilities are never published here; they go through Immunefi or Cantina bounty programmes.Clear findings in 24h · $5,000 USDC →