Bonzo Lend loses $9.05M after Supra oracle accepts unsigned price update
Security & Exploits ·
Attacker exploited a zero-signature verification gap in Supra's price feed to manipulate SAUCE token pricing and drain the Hedera lending protocol.
Bonzo Lend, described as Hedera's largest lending protocol, lost $9.05 million after an attacker exploited a flaw in how the Supra oracle verifies incoming price data, according to theblock.co. The exploit centered on a zero-signature SAUCE price update that Supra's verifier accepted without proper cryptographic checks, letting the attacker push a manipulated price into the protocol's lending logic.
The breach illustrates a structural weakness that oracle systems are designed to prevent. Price feeds exist to bridge off-chain data into deterministic on-chain contracts, and the industry standard for avoiding manipulation is to require cryptographic signatures from multiple independent node operators before a price is accepted. When a verifier accepts an update lacking that signature, the safeguard collapses, and a single manipulated data point can flow directly into collateral valuations and liquidation triggers.
Coverage of the incident has been corroborated across multiple outlets, with four distinct sources describing the same mechanism: a manipulated price update accepted by Supra's verifier that Bonzo Lend's lending market then treated as legitimate. wublockchain.xyz also reported on the exploit, aligning with the figure of roughly $9 million in losses tied to the Hedera-based protocol.
The episode echoes a broader pattern documented across DeFi oracle failures, where redundancy alone does not guarantee safety if verification steps are improperly implemented or bypassed. Related incidents referenced in wider oracle coverage — including a Venus Protocol event where liquidation bots processed thousands of liquidations after a manipulated price move, and a separate oracle misconfiguration blamed for an attack on Ribbon Finance — underscore that the failure mode is rarely the absence of an oracle, but rather a gap in how price data is validated before it reaches a smart contract.
What remains unclear is how the zero-signature update was permitted to pass verification in the first place, whether Supra has issued a patch or advisory addressing the flaw, and whether Bonzo Lend plans any remediation, insurance response, or funds recovery effort. Also unresolved is whether other protocols relying on the same Supra verifier configuration face similar exposure, a question likely to shape the next phase of scrutiny following the exploit.