Zeroed Oracle Signature Drains $9 Million From Hedera Lender Bonzo Lend

An attacker drained roughly $9.05 million from Bonzo Lend, the largest lending protocol on the Hedera network. The attacker exploited a price oracle supplied by a third party rather than any flaw in Bonzo's own contracts, according to CryptoSlate and The Block.

The attack turned on a verification failure in a Supra oracle contract. The attacker submitted a price update whose signature field was set to two zeros, and the committee public key it referenced was also the zero point that cryptographers call the point at infinity. Because both values represented the mathematical identity element, the pairing equation the verifier used returned true, and the contract treated that result as proof of a valid committee signature. The verifier did not screen out zero, identity, or off-subgroup inputs before running its check.

With a forged price accepted, the attacker deposited 250 SAUCE tokens, worth only a few dollars, pushed the reported SAUCE price up by about twelve orders of magnitude, and within seconds borrowed roughly 6.6 million USD Coin and 34.5 million Wrapped HBAR against that tiny collateral. Bonzo Lend's total value locked fell about 77% after the attack, CoinDesk reported.

Bonzo Lend paused the protocol and its points program while it pursues recovery, and Supra acknowledged the defect and deployed a fix. The stolen funds have not been recovered, and the team attributed the loss to the outside oracle rather than its lending logic.