Digital Finance & Tokenization▼impact 4
Hedera Lending Protocol Bonzo Loses $9 Million in Oracle Attack
Bonzo Lend, a decentralized lending protocol on the Hedera network, suffered an attack that exploited a vulnerability in an external oracle, resulting in the unauthorized borrowing of approximately $9.05 million in assets. The attacker deposited 250 SAUCE, worth just a few dollars, as collateral, then sent a fake price update to the on-demand contract of the third-party oracle Supra, inflating the market price of SAUCE by roughly 12 orders of magnitude. Eight seconds later, the attacker borrowed 6.63 million USDC and 34.52 million WHBAR from the lending pool. The core of the attack lay in a flaw in Supra's verification mechanism: the signature fields of the submitted update were all zeros, yet the verification contract accepted them as valid signatures. Bonzo Finance Labs, the operator, emphasized that Bonzo Lend's own contracts functioned as designed and that the damage occurred at the upstream oracle layer. After the attack, another wallet borrowed around $1 million, but this amount was not included in the $9.05 million loss figure because the wallet claimed to be a white hat hacker and expressed intent to return the funds. Supra has applied a fix, but Bonzo Lend remains paused.