Bonzo Finance loses about $9 million in oracle attack on Hedera

Bonzo Finance, a lending protocol built on Hedera, lost about $9 million in an oracle attack, according to Odaily. In its preliminary incident report, the protocol said the attacker deposited just 250 SAUCE tokens, then submitted a price update that artificially inflated SAUCE by roughly 12 orders of magnitude. Using the overstated collateral value, the attacker borrowed assets far beyond their real worth from the lending pool. Bonzo Finance said the address went on to borrow 6.63 million USDC and 34.5 million wrapped HBAR. The protocol added that the incident was not caused by a flaw in Bonzo Finance’s smart contracts or in the Hedera base network itself. Instead, it traced the issue to a vulnerability in the on-chain oracle validator operated by oracle provider Supra. According to the report, Supra’s validator incorrectly accepted SAUCE price data with a zeroed signature. Supra has since confirmed the issue and completed a fix. The case highlights how oracle failures can expose lending markets even when the core protocol logic is not identified as the direct source of the exploit.