Main takeaway: Bonzo Lend lost about $9 million after an attacker exploited an oracle bug to inflate Sauce token prices. The attacker deposited 250 Sauce, posted a price update that raised value ~12 orders of magnitude, then borrowed 6.63M USDC and 34.5M wrapped HBAR. Bonzo Lend said the issue was an oracle failure, not a contract or Hedera core network bug.
币界网消息，Hedera基于的借贷协议Bonzo Lend因预言机漏洞损失约900万美元。攻击者通过操纵Sauce作为抵押品的价格，借走了超过900万美元的资产。Bonzo Lend在初步事件报告中表示，攻击者先存入250个Sauce（仅值几美元），然后提交了一个将该代币价值抬高约12个数量级的价格更新。该钱包随后从借贷池中借走了663万USDC和3450万Wrapped HBAR。该事件突显了预言机故障如何将低价值抵押品转变为从借贷协议中抽取大量流动性的工具。Bonzo Lend指出，事件并非其合约或Hedera核心网络的漏洞。