Bonzo Finance Suffers $9 Million Loss in Oracle Attack

Bonzo Finance, a lending protocol within the Hedera ecosystem, suffered an oracle attack on July 11. This resulted in losses of approximately $9 million.

The attacker exploited the SAUCE token price by artificially inflating its value, which allowed them to borrow assets from the protocol far exceeding their real worth.

According to Bonzo's preliminary incident report, the attacker deposited only 250 SAUCE tokens and then submitted a price update, raising the token's price by about 12 orders of magnitude.

The attack did not stem from vulnerabilities in Bonzo's smart contracts or Hedera's underlying network. Instead, it originated from a flaw in the oracle provider Supra's on-chain oracle validator.

Supra has since acknowledged the issue and completed its fix.