Bonzo Lend, a noncustodial lending and borrowing protocol built on the Hedera (HBAR) network, was recently exploited. This exploit occurred after an oracle exploit allowed the attacker to borrow assets in excess of the specified collateral. As a result, Bonzo Lend suffered a loss of $9.05 million.
Preliminary findings linked the breach to a flaw in Supra’s signature verification, enabling manipulation of SAUCE price feeds. The attacker then took out unsecured loans before the protocol halted activity.
In a post on X, Hedera confirmed that Bonzo Lend’s smart contracts and Hedera’s core network were not compromised. This discovery narrowed the failure to external oracle infrastructure rather than blockchain security.
Meanwhile, the abuse quickly spread to market sentiment. At the time of writing, HBAR dropped to approximately $0.068, while Hedera’s DeFi TVL dropped by 21.43% to $25.4 million. This decline reflected capital withdrawals, although the network remained uncompromised.
However, this exploit revealed the growing importance of flexible price oracles. As recovery efforts continue, stronger oracle protections and verification standards will likely become necessary to protect DeFi lending protocols.
Oracle flaw exposes DeFi risk
An audit of Bonzo Lend’s smart contracts determined that there were no issues with this. Yet he also determined how successful the attack was. Even though the protocol had read a manipulated SAUCE price to calculate the collateral exactly as defined by the protocol, it had done so exactly as designed.
Auditors ruled out flash loans and market manipulation based on their observations that SAUCE trading volumes reached only a few thousand dollars.
Instead of using these methods, the attacker took advantage of the protocol’s dependence on trusted oracle inputs. Even if the code works perfectly, attackers can use protocol rules as weapons against users and protocol owners. This pattern reflects a recurring DeFi risk where rules become weaponized despite flawless code execution. Such protocol logic exploits remain a recurring category in DefiLlama’s hack database.
Therefore, such an iterative pattern is driving protocols to adopt economic simulations, formal verification, and bug bounties in addition to traditional smart contract audits.
Final Summary
- Hedera oracle exploit exposed critical risks to reliable price feeds.
- HBAR showed that the right protocol logic can still enable multimillion-dollar exploits.
