Supra oracle exploit lets attacker drain $9.05M from Bonzo Lend using zero-signature SAUCE price update

An attacker submitted a SAUCE price about 12 orders of magnitude above market after Supra's Hedera verifier accepted a zeroed BLS signature, then used 250 SAUCE as collateral to extract $9.05 million from Bonzo Lend. Bonzo paused Lend at 01:41 UTC after the malicious wallet borrowed 6.63 million USDC and 34.52 million WHBAR. A second wallet said it acted as a white hat and plans to return the additional principal it borrowed, about $1 million.

TLDR by @Benthic

Explore the topic

• update
• Exploit
• Oracle