Bonzo Lend on Hedera suffered a $9M exploit via manipulated price feed accepted by Supra oracle verifier.
Security & Exploits ·
Bonzo Lend, a lending protocol on Hedera, sustained a $9 million exploit after a Supra oracle verifier processed a manipulated price feed. The breach highlights a vulnerability in the protocol's reliance on the external oracle for real-time asset pricing without sufficient safeguards against fraudulent updates.
The attack leveraged the acceptance of a false price signal by the Supra verifier, allowing the attacker to exploit the discrepancy between the manipulated price and actual market values. This enabled unauthorized borrowing or withdrawal of protocol funds pegged to the inflated or deflated asset valuation.
The incident raises questions about the verification mechanisms within Supra's oracle infrastructure and whether Bonzo Lend had implemented secondary price validation layers or circuit breakers to detect anomalous updates. No details have been disclosed regarding recovery of funds or remediation steps announced by either party.