How a Zeroed Oracle Signature Unlocked $9 Million from Bonzo Lend
The Curious Case of Bonzo Lend
Ever heard of Bonzo Lend? No, it’s not a new circus act but a lending protocol based on Hedera. Recently, they managed to get themselves into quite the pickle when withdrawals were abruptly halted.
Oops! That’s a Zeroed Signature!
Here’s the scoop: A sneaky wallet managed to borrow an eye-popping $9.05 million against just 250 SAUCE. Yup, you heard that right—just 250 SAUCE. Now, if you’re wondering how in the crypto world that’s even possible, you’re in for a treat.
The Magic (or Not So Magic) Moment
At the stroke of 00:51 UTC, our cheeky wallet made a move. It threw in an update for SAUCE/wHBAR prices that shot the token’s perceived value up by about 12 orders of magnitude—turns out, reality had other plans because the market price was chilling around 0.2 HBAR.
In a flash, eight seconds later, the wallet borrowed 6.63 million USDC and followed it up with another grand move, borrowing 34.5 million wrapped HBAR. The grand total? A cool $9.05 million—all thanks to some confusing math and a whole lot of luck.
How Did This Happen?
But wait, there’s more! The update submitted had a signature field that was just a big fat zero. Seriously, it was [0,0]. And get this—the public key was also a big zero, or as the tech whizzes like to call it, the point at infinity. You’d think that’s a red flag, but nope! The oracle just sat there, assuming everything was hunky-dory and returned a thumbs up. It’s like giving a handshake to a ghost!
Wallet A and Wallet B: A Tale of Two Wallets
Meanwhile, Wallet B got in on the action and borrowed around $1 million while the price was still on its wild ride. This wallet had a bit of a conscience, though, and reached out to Bonzo claiming to be a white-hat hero ready to return the loot. As of now, Bonzo has counted that million as technically “recovered,” even though no one’s actually seen it back in action yet.
What’s Next for Bonzo?
As it stands, Bonzo is on lockdown, still figuring out what went wrong and how to make it right. They’ve acknowledged that the oracle’s verifier needs a serious makeover, but until then, the lending pool is closed tighter than a clam.
Unanswered Questions and the Road Ahead
So, what’s next on everyone’s mind? Will the verifier finally learn to reject those pesky zero inputs? Will Bonzo tighten its collateral conditions? And when oh when can we expect withdrawals to resume? There’s still no official word from Bonzo, leaving us all on tenterhooks!
The Bottom Line
As of July 13, Bonzo hasn’t given an update about when things might return to normal. It’s like waiting for the next season of your favorite show—frustrating! Keep your ears to the ground, folks, because this saga is far from over.