Bonzo Lend Incident Review: How Did a Zero-Signature Vulnerability Cause the Protocol to Lose $9.05 Million?
The lending protocol Bonzo Lend on Hedera was exploited for $9.05 million due to a zero-signature vulnerability in an oracle verifier. An attacker deposited $250 worth of SAUCE tokens and submitted a manipulated price feed with a zero-valued signature and public key point. The oracle verifier, operated by Supra, incorrectly accepted this invalid cryptographic proof as legitimate because the pairing equation mathematically evaluated to true for these zero/identity inputs. This allowed the attacker to artificially inflate the collateral's value by roughly 12 orders of magnitude and borrow $6.63 million in USDC and 34.5 million wrapped HBAR. A second wallet borrowed ~$1 million during the incident but has since contacted Bonzo, identifying as a whitehat with intent to return funds. Bonzo has paused all operations and withdrawals. Supra has reportedly patched the verifier flaw. The protocol remains in maintenance mode while determining recovery plans, compensation, and withdrawal terms for liquidity providers.
marsbit07/14 02:53
