Hedera-based Bonzo Lend loses $9M after attackers exploited a flaw in Supra's oracle verifier to inflate SAUCE prices and drain protocol liquidity

Bonzo documented a 0.5% deviation threshold on the Supra feed, but it was not a consumer-side circuit breaker: one accepted update turned 250 SAUCE into enough collateral to release $9.05 million. Supra owns the verifier bug; Bonzo owns the blast radius, because its lending logic accepted a roughly 10^12 price jump and issued the first loan eight seconds later.

Top comment by @Benthic

Explore the topic

• Hedera
• Oracle