Bonzo Lend / Supra Oracle — BLS Zero-Signature Price Forgery

Source & credit. Original research reproduction (not from DeFiHackLabs). Standalone Foundry PoC, offline anvil_state.json, and full write-up: 2026-07-BonzoLend_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/auth/signature-validation · vuln/oracle/missing-validation · vuln/oracle/price-manipulation · vuln/input-validation/missing-validation

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. The fork is served offline from the bundled anvil_state.json (local anvil serves a mainnet-shaped snapshot at block 22800000 solely for the BN254 pairing precompile; the vulnerable stack is deployed in-test as a portable pure-EVM model of Supra + Bonzo), so no public RPC is required. Full verbose trace: output.txt. Reconstructed verifier / pull / mini-lend sources: VulnerableBLSOracle.sol (RECONSTRUCTED from BlockSec + Bonzo Finance public reports; Hedera bytecode is not fully forkable under Foundry today — see tooling notes).

Key info#

TL;DR#

1. Bonzo Lend prices ecosystem collateral (including SAUCE) from Supra's on-chain pull-oracle feed. It does not re-verify committee signatures; it reads the latest stored value.

2. Supra's update path calls verifyOracleProofV2 → requireRootVerified → requireHashVerified_V2 → BLS.verifySingle, which hands a pairing product to Hedera's BN254 precompile (0.0.8 / EIP-197 0x08).

3. The verifier never rejected the G1/G2 identity (zero) points. Wallet A submitted pair 425 (SAUCE/WHBAR) with committee ID 2 and signature [0,0]. Committee pubkey[2] was also the identity. The pairing product of identity inputs is mathematically 1, so the precompile returned true — not because a real signature existed, but because the equation held for the wrong inputs.

4. The forged root was accepted; packData wrote price 10**30. Eight seconds later Wallet A borrowed ~6.63M USDC and ~34.5M WHBAR against 250 SAUCE collateral. Headline loss ~$9.05M.

5. This is a smart-contract cryptographic validation bug (missing zero-point checks), not a compromised oracle key (contrast Ostium). Supra deployed a fixed implementation after the incident (0x02ebd8… at latest).

Background#

Protocol model#

Historical call parameters (oracle update)#

Decoded from attack tx 0xd50c55…0a60 input selector 0x03a02dfd:

The vulnerable code#

RECONSTRUCTED teaching model (sources/SupraBLS_reconstructed/VulnerableBLSOracle.sol), matching the BlockSec snippet for requireHashVerified_V2 and the Bonzo Finance incident report. Live Hedera sources were not fully recoverable into a Foundry fork (see tooling notes).

function requireHashVerified_V2(
    bytes32 _message,
    uint256[2] calldata _signature,
    uint256 committee_id
) public view {
    bool callSuccess;
    bool checkSuccess;
    (checkSuccess, callSuccess) = BLS.verifySingle(
        _signature,
        committee_public_key[committee_id],
        BLS.hashToPoint(domain, abi.encode(_message)),
        blsPrecompileGasCost
    );
    if (!callSuccess) {
        revert BLSInvalidPublicKeyorSignaturePoints();
    }
    if (!checkSuccess) {
        revert BLSIncorrectInputMessaage();
    }
    // MISSING: reject signature == (0,0), reject pubkey == identity,
    //          reject off-subgroup points before trusting checkSuccess.
}

PoC library path (pairing call with no zero-point gate) (VulnerableBLSOracle.sol:70-103):

function verifySingle(
    uint256[2] memory signature,
    uint256[4] memory pubkey,
    uint256[2] memory message
) internal view returns (bool checkSuccess, bool callSuccess) {
    // ... build 12-limb EIP-197 input from sig / nG2 / H(m) / pk ...
    assembly {
        callSuccess := staticcall(gas(), 0x08, input, 0x180, out, 0x20)
    }
    checkSuccess = out[0] != 0;
}

When signature = (0,0) and pubkey = (0,0,0,0), the pairing product is the multiplicative identity. Offline trace (output.txt:1598-1601):

PRECOMPILES::ecpairing([0, 0, nG2…], [1, 2, 0, 0, 0, 0]) → true
requireHashVerified_V2(root, [0,0], 2) ACCEPTED

Root cause#

This is not key compromise: no legitimate committee secret was needed.

Preconditions#

1. Supra verifier missing zero-point checks (pre-fix implementation 0x63e0a27b…fbf0).
2. Committee public key for ID 2 is the G2 identity (or otherwise pairable to identity with a zero signature under the buggy path).
3. Pull-oracle allows unauthenticated submitters to call verifyOracleProofV2 (permissionless update path with proof).
4. A lending protocol (Bonzo) that reads the stored feed without a secondary sanity/circuit-breaker on SAUCE magnitude.

Attack walkthrough#

Historical Hedera timeline (UTC, 2026-07-11): deposit 00:39 → forged update 00:51:39 → USDC borrow 00:51:47 → WHBAR borrow 00:51:57 → legitimate feed restore ~01:36 → Bonzo pause 01:41.

Diagrams#

Remediation#

1. Reject identity / zero points for both signature (G1) and public key (G2) before any pairing call; also enforce subgroup checks.
2. Never treat precompile true as authentication without those checks — mathematical validity ≠ cryptographic authenticity.
3. Committee key hygiene: refuse to configure or leave a zero/identity committee public key in production storage.
4. Consumer circuit-breakers: lending protocols should bound price deviations / max collateral factors for thin ecosystem feeds, even when the oracle is “verified.”
5. Supra’s post-incident fix (new implementation 0x02ebd8… on the same proxy) should be independently reviewed for the full BLS validation checklist.

Hedera tooling notes (honest)#

PoC strategy chosen: portable pure-EVM reconstruction that (a) proves the pairing identity acceptance, (b) proves requireHashVerified_V2 accepts [0,0] for committee 2 with zero pubkey, (c) writes pair 425 at 1e30, and (d) borrows the historical USDC principal against 250 SAUCE. WHBAR leg and HTS nuances are documented but not executed.

How to reproduce#

cd ~/RustroverProjects/audits/evm-hack-registry
_shared/run_poc.sh 2026-07-BonzoLend_exp -vvvvv
# → [PASS] testExploit() ; Attacker USDC profit: 6634528.202695

No public RPC required when anvil_state.json is present.

Reference: BlockSec weekly — Summer.fi / Bonzo Lend · Bonzo Finance incident report

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-07-BonzoLend_exp (evm-hack-registry mirror).
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.