Zeroed oracle signature allowed $9M drain at Bonzo Lend

Bonzo Lend paused withdrawals and placed affected markets under maintenance after an oracle update that used a zeroed signature and a zero committee public key was accepted by the protocol’s verifier. The incident occurred on the Hedera network and left liquidity providers unable to withdraw funds while recovery plans are decided.

At 00:51 UTC a wallet that had deposited 250 SAUCE submitted a SAUCE/wHBAR price update that inflated the token’s on-chain price by roughly 12 orders of magnitude while the market price remained near 0.2 HBAR. Eight seconds after the manipulated price reached the oracle’s on-chain storage, the wallet borrowed 6.63 million USDC and then 34.5 million wrapped HBAR, a combined principal of about $9.05 million using Bonzo’s reference prices.

A second wallet borrowed roughly $1 million during the same window and later identified itself as a white-hat responder intending to return the funds. Bonzo counted about $1 million as recovered, though the final amount has not been settled.

The technical failure came from the verifier accepting identity inputs as a valid proof. The submitted update had a signature field set to zero and a committee public key at the mathematical zero point, also known as the point at infinity. Supra’s verifier forwarded those inputs to Hedera’s pairing precompile. Because both inputs represented the mathematical identity, the pairing equation evaluated to true. The verifier did not first reject zero or off-subgroup inputs and treated the pairing result as proof of a committee signature. Supra applied a patch to the verifier to prevent acceptance of identity inputs.

Bonzo Finance Labs and the Bonzo Finance Foundation are determining a recovery plan, reimbursement terms and conditions for reopening. Bonzo’s status page listed the incident as unresolved and showed affected markets under maintenance as of July 13, with the platform reported paused since July 11. No timeline for reopening or user-facing withdrawal arrangements has been posted.

Outstanding operational questions include whether regression testing will confirm the verifier now rejects zero and off-subgroup inputs, whether additional checks for sudden price deviations will be added, whether collateral parameters will be tightened to limit exposure, and how on-chain assets will be handled when withdrawals resume.

Bonzo Lend is a lending protocol on the Hedera network that issues loans in assets including USDC and wrapped HBAR against token collateral. The exploited position began as a small SAUCE deposit and grew when the oracle accepted the manipulated price, triggering the protocol’s loan-to-value controls and allowing the large principal to be drawn before activity was halted.