Moonwell is facing a governance attack after a $1,800 token purchase was used to push a proposal that could drain over $1 million.