Bonzo Lend, a lending protocol on Hedera, has locked withdrawals after an oracle verifier accepted a proof with a zero signature and zero public key, letting one wallet borrow about $9.05 million against 250 SAUCE.
As of July 13, Bonzo Lend and Bonzo Points were still paused. The protocol’s official status page showed Bonzo Lend and all affected asset markets under maintenance. Liquidity providers could not withdraw while Bonzo Finance Labs and Bonzo Finance Foundation worked on a recovery path and reopening conditions.
Manipulated SAUCE price unlocked millions in borrowing
Wallet A first deposited 250 SAUCE, worth only a few dollars. At 00:51 UTC, it submitted a SAUCE/wHBAR price update that overstated the token’s value by about 12 orders of magnitude, even as the market price remained near 0.2 HBAR.
Eight seconds after the manipulated price reached the oracle’s onchain storage, the wallet borrowed 6.63 million USDC. It then borrowed 34.5 million wrapped HBAR. Using Bonzo’s reference pricing, the principal taken out by wallet A totaled about $9.05 million.
Why the verifier passed zero values
The submitted update did not include a valid oracle signature. Its signature field was [0, 0], and the referenced committee public key was also the zero point, known in cryptography as the point at infinity.
Supra’s verifier sent those inputs to Hedera’s pairing precompile. Because both points represented mathematical identities, the pairing equation returned true as designed. The verifier then treated that output as proof of committee authorization because it did not first reject zero values, identity elements, and non-subgroup inputs.
Put simply, the network correctly answered the equation it was given. The verifier mistook that answer for authorization.
Bonzo said its lending contracts then used the price already stored by the oracle and executed according to the protocol’s loan-to-value rules.
White hat response did not end the pause
A second wallet, wallet B, borrowed about $1 million while the abnormal price was still live. That wallet later contacted Bonzo, said it was acting as a white hat responder, and stated an intention to return the funds.
Bonzo said about $1 million has been recovered in its accounting, although the funds have not yet been returned and the final amount remains unsettled.
Bonzo also said Supra has fixed the verifier, but the lending pools remain closed. Open questions include whether regression testing confirms the verifier now rejects identity inputs, whether Bonzo will add price deviation checks or tighten collateral parameters, and how available assets will be handled when withdrawals reopen.
As of July 13, Bonzo’s official status page still listed the incident as unresolved. Its latest formal update, published on July 11, said the protocol remained suspended.
Bonzo has not announced compensation, a reopening date, or withdrawal terms for users.