Crypto
Home›Crypto›Market Structure›Bonzo Lend locks withdrawals after oracle bug enabled…
Bonzo Lend locks withdrawals after oracle bug enabled $9.05M borrow
Hedera’s oracle verifier accepted a zeroed signature and public key, causing a manipulated SAUCE price update to be used for loan-to-value calculations.
Hedera-based lending protocol Bonzo Lend has locked withdrawals after an oracle verifier accepted identity inputs that allowed wallets to borrow against SAUCE. According to CryptoSlate, Bonzo Lend and Bonzo Points were paused as of July 13, with the protocol’s status page listing Bonzo Lend and affected asset markets as under maintenance.
CryptoSlate reports that Wallet A first deposited 250 SAUCE, then at 00:51 UTC submitted a SAUCE/wHBAR price update that inflated the token’s value by roughly 12 orders of magnitude on-chain, even though the token was near 0.2 HBAR in the market. Eight seconds later, once the manipulated price reached the oracle’s on-chain storage, the wallet borrowed 6.63 million USDC and then 34.5 million wrapped HBAR, bringing principal extracted to about $9.05 million at Bonzo’s reference prices.
The issue, as described by CryptoSlate, involved a submitted update that contained no valid oracle signature. The signature field was [0,0] and the referenced committee public key was also the zero point, known as the point at infinity, and the verifier sent these inputs to Hedera’s pairing precompile, which returned true even though authorization should have been rejected.
CryptoSlate also said a separate Wallet B borrowed roughly $1 million while the abnormal price remained live, then contacted Bonzo as a white-hat responder and said it would return the funds. Bonzo reported that about $1 million was recovered so far, while the final tally was still unsettled as Bonzo Finance Labs and the Bonzo Finance Foundation determined a recovery path and conditions for reopening.