Bonzo Finance, a lending protocol in the Hedera ecosystem, suffered an oracle attack resulting in a loss of approximately $9 million.

```htmlJinse Finance reported that on July 11, the Hedera-based lending protocol Bonzo Finance suffered a price oracle attack, resulting in losses of approximately 9 million US dollars. The attacker used artificially inflated collateral based on the SAUCE token price to borrow assets from the protocol far exceeding their real value. According to Bonzo's preliminary incident report, the attacker deposited only 250 SAUCE tokens, then submitted a price update, artificially raising the token's price by about 12 orders of magnitude. Afterward, the address borrowed 6.63 million USDC and 34.5 million wrapped HBAR (wHBAR) from the lending pool. It is claimed that this attack did not stem from vulnerabilities in Bonzo's smart contracts or Hedera's underlying network, but originated from a flaw in the oracle provider Supra's on-chain oracle validator. The validator erroneously accepted a SAUCE price data point with a zeroed signature; Supra has since acknowledged the issue and completed its fix.```