Bonzo Lend suffers ~$9.05M hit after attacker poisons SAUCE oracle feed
Hedera-based lending protocol Bonzo Lend lost approximately $9.05 million after a bad oracle value let an attacker vastly overstate the price of SAUCE used as collateral. Bonzo Finance Labs says the incident began on July 11, 2026, when a wallet submitted a false SAUCE price to a third‑party Supra oracle feed.
What happened
- The attacker deposited just 250 SAUCE — a holding worth only a few dollars — moments before the tampered oracle feed reported an inflated SAUCE price. Eight seconds after the bogus price propagated, the wallet was able to borrow 6.63 million USDC and more than 34.5 million wrapped HBAR against the manipulated collateral value. Bonzo reports the headline loss as roughly $9.05 million.
- The protocol paused Bonzo Lend at 01:41 UTC and later halted Bonzo Points that morning. Other Bonzo services — Bonzo Vaults, Bonzo Bridge and single‑sided BONZO staking — continued to operate.
How the oracle failed
- Bonzo’s post‑mortem traces the root cause to Supra’s signature verification process. The malicious update carried a zeroed signature rather than a valid committee signature. The verifier did not reject zero‑value inputs and forwarded them to Hedera’s pairing system contract.
- The pairing check returned true because both values mapped to the mathematical identity point, which Supra’s contract then treated as proof of a valid committee signature. Bonzo emphasizes that “no valid oracle signature was forged” and that SAUCE’s real market price did not spike — the issue was a faulty verification acceptance of a zeroed signature.
- Supra has since deployed a fix to the affected verifier contract on Hedera mainnet.
Protocol behavior and response
- Bonzo says its lending contracts correctly read the (manipulated) value from the approved oracle feed and computed borrowing power accordingly — in other words, the lending pool behaved as designed given the false input. The team ruled out a Bonzo contract bug, a flash‑loan exploit, or ordinary market manipulation as causes.
- A second account took about $1 million while the abnormal price remained active. That wallet later contacted Bonzo claiming to be a white‑hat and said it planned to return the assets. Bonzo excluded that $1 million from the $9.05 million headline figure while recovery talks remain ongoing; the report has not confirmed any return.
On‑chain tracing and market impact
- Prior to Bonzo’s disclosure, security researchers tracked more than $5.8 million moving from Hedera to Ethereum. They say the funds were bridged via LayerZero and that some wrapped Bitcoin was converted into Ether. HBAR traded down more than 2% while transfers continued.
- Bonzo’s oracle documentation shows Supra feeds for SAUCE, HBARX, XSAUCE, DOVU, PACK, KARATE, STEAM and HST against wrapped HBAR; the incident affected the SAUCE pair specifically. Legitimate publishing restored the SAUCE price to about 0.1964 HBAR at 01:36 UTC — roughly five minutes before the lending pool pause.
Next steps
- Bonzo Lend remains paused as Bonzo Finance Labs and the Bonzo Finance Foundation coordinate with partners on asset recovery, protocol repairs and withdrawal plans for liquidity providers. No reopening date for the lending pool has been announced.
- The protocol’s findings have been shared publicly (also summarized by Wu Blockchain), and Supra says it has fixed the verifier bug on mainnet.
This incident highlights the systemic risk posed by oracle integrity: even well‑functioning lending contracts can be exploited if a trusted price feed accepts malformed signatures.
Read more AI-generated news on: undefined/news
