Bonzo Lend drained for $9M in Hedera oracle exploit
A single verifier-side price bug let an attacker mint $9M of unbacked borrowing power on Hedera's largest lending market.
SaucerSwap is a decentralized exchange protocol built on the Hedera network, deployed as non-upgradable smart contracts that prioritize censorship resistance, self-custody, and security. By utilizing the Hedera Token Service, the protocol benefits from high throughput, low transaction costs denominated in U.S. dollars, and fair transaction ordering that removes the risk of MEV extraction commonly associated with Ethereum-based exchanges. The protocol is offered in two versions: V1, a constant product automated market maker, and V2, which adds concentrated liquidity functionality for improved capital efficiency. SAUCE is the native utility and governance token of the ecosystem, issued on Hedera. Holders can participate in the SaucerSwap DAO by voting on proposals related to protocol upgrades and incentive structures, and SAUCE is distributed through a Masterchef contract to reward liquidity providers across both protocol versions. Additionally, token holders may stake SAUCE to receive a share of trading fees, HBAR staking rewards, and emissions governed by an automated buyback mechanism.
A single verifier-side price bug let an attacker mint $9M of unbacked borrowing power on Hedera's largest lending market.
The attacker slipped a fake price past Supra oracle verification, borrowing $10M against 250 worthless SAUCE tokens. Nearly all of Hedera's DeFi value walked out the door in 24 hours.
The attacker used a signature-verification bug in Supra's oracle to spoof SAUCE prices, borrow against phantom collateral, and drain roughly $9.05M before the protocol was paused.
SaucerSwap is the leading decentralized exchange protocol on the Hedera network, implemented as a set of non-upgradable smart contracts focused on censorship resistance, security, and self-custody.
SaucerSwap (SAUCE) is categorised as: Decentralized Exchange (DEX), Exchange-based Tokens, Decentralized Finance (DeFi).
The official SaucerSwap site is https://www.saucerswap.finance/.
Most recent SaucerSwap coverage: "Bonzo Lend drained for $9M in Hedera oracle exploit" — read at /en-US/a/bonzo-lend-drained-for-9m-in-hedera-oracle-exploit.