The verifier was 102 days old

Rounding. Token amounts are reproduced at full published precision. Derived USD figures are computed unrounded and displayed to the cent. Percentages are displayed to two decimals as published by the data source. Durations are given to the tenth of a second when both endpoints carry sub-second precision, otherwise to the minute. Any figure whose rounding changes its interpretation is shown both ways.

Clock. The Hedera consensus timestamp encoded in a transaction identifier is the canonical clock. Where a party's published time diverges from it, both are shown and the divergence is flagged UNRESOLVED. Intervals are computed from the party-reported clock so they remain comparable to the published record.

Terminology. Manipulated write denotes the transaction that placed the fraudulent price on-chain. Draw denotes a borrow against the resulting collateral valuation. These two terms are used throughout to the exclusion of synonyms.

Supra states that an out-of-bounds committee identifier could produce null key material, while its on-chain verifier did not reject identity or null elements. That combination allowed a fraudulent pull-oracle update to pass verification and write a manipulated SAUCE/wHBAR pricePRIMARY-SUPRA

Supra also states that its off-chain computation, aggregation and signing were not compromised, that no valid Supra attestation existed for the fraudulent price, and that the incident was confined to SAUCE/wHBAR, pair 425, on Bonzo Finance. Its push oracle was unaffectedPRIMARY-SUPRA

The verification predicate returned true for an input pair on which it had no defined rejection condition. The precompile evaluated the equation it was given correctly; the verifier supplied it with operands it should have rejected beforehand.

Control failure matrix

What the chain adds

Two facts below were read from the Hedera mirror node directly. Neither appears in either party's disclosure or in any coverage reviewed.

The vulnerable implementation was 102 days old. The verifier at 0.0.4323006 is a proxy, created 19 December 2023ON-CHAIN A proxy's creation date is not its implementation's. The implementation it pointed at when the manipulated write landed was deployed on 31 March 2026 — 102 days before the incidentON-CHAIN

The two-year figure is a reasonable reading. The proxy address genuinely is that old, and explorers surface the proxy first. The distinction between a proxy and the implementation behind it is the kind of thing that gets flattened when an incident is written up at speed. The record was public the whole time. It required asking the chain a second question.

What changes with the correct figure: this was not dormant legacy code that nobody had looked at since 2023. It was a recent deployment. Whatever review process preceded it did not catch a degenerate-operand case in a signature verifier.

The fix landed 6 hours 17 minutes after the exploit. Supra declared the three guards live on 11 July without publishing a time. The upgrade transaction carries a consensus timestamp of 07:08:24 UTC that dayON-CHAIN — 6h 17m after the manipulated write at 00:51:39.646.

The degenerate pairing, formally

A BLS verification checks one equality:

where σ is the signature in G₁, pk the public key in G₂, H(m) the hashed message, and e the bilinear pairing. Bilinearity gives the identity e(O, Q) = 1 for the point at infinity O and any Q — a property of the map, not a defect in its implementation.

Supra's account describes two inputs arriving together: an out-of-bounds committee identifier resolving to null key material, and proof elements at identityPRIMARY-SUPRA Under those two conditions the equality reads 1 ≟ 1. It is satisfied for every message. The predicate is not weak — it is undefined, because no rejection condition was expressed for operands of this shape.

This is why the fix is three guards and not one: committee resolution, identity rejection, and on-curve plus subgroup validation each close a different way of reaching a degenerate operand.

Two distinct failures, one cascade. The verification bypass is the technical cause: without it, no fraudulent price is written. The absence of a plausibility bound on the consuming side is a containment failure: without it, a data anomaly becomes liquidity extraction. Merge them and you misattribute the defect.

No component reverted. No error was raised.

Verification path

Every claim above is checkable without privileged access.

We did not decode transaction call traces or examine verifier bytecode. The mechanism above is reconstructed from both parties' technical disclosures and the cryptographic property they describe — not from independent decompilation. Any claim that would require decompilation to establish is marked UNRESOLVED.

All intervals FC-DERIVED from the timestamps above. The manipulated write's consensus timestamp was read directly from the Hedera mirror node and matches Bonzo's published time to the millisecond.

The manipulated write resolves to an ETHEREUMTRANSACTION, result SUCCESS, calling entity 0.0.4323024 — the pull oracle, not the verifier. Charged fee: 40,707,546 tinybars against a 1,815,000,000 maximumON-CHAIN

Every identifier above is public; readers are invited to resolve them on hashscan.io independently.

Post-exploit flows. Third-party on-chain analysis reports that a portion of the funds was bridged to Ethereum via LayerZero and converted, including WBTC to ETH, and that an aggregation address associated with these flows was initially funded with 1 ETH from Tornado CashTHIRD-PARTY No reconciled amount has been publishedUNRESOLVED

This describes reported on-chain movement. It does not identify who controls these addresses, and no inference about that should be drawn from it.

Bonzo Finance publicly attributed the failure to a vulnerability in the third-party oracle provider's verification mechanismPRIMARY-BONZO Supra published a technical incident report the same day at 13:55 UTC and located the triggering defect in its own on-chain verifierPRIMARY-SUPRA

Supra also states that Bonzo could have limited the impact through sanity bounds and circuit breakers on a thin-liquidity assetPRIMARY-SUPRA

Supra identifies the triggering defect in its on-chain verifier. This report takes no position on legal responsibility between the two parties.

Dataset: DefiLlama historical TVL series · slug bonzo-lend · 29 daily points · 26 June to 22 July 2026. Absolute values at J0, J+1 and J+7 are FC-DERIVED from the baseline and the published percentages. Scope note: the bonzo-finance aggregate, which includes Vaults and Bridge, shows a decline 2.2 points shallower. Those products were unaffected, so the pool-level series is the correct scope.

Figure 1 · The decline does not stop when the extraction stops.

Figure 2 · The withdrawal outlasted the extraction by a full day.

The second day matters as much as the first. J0 removed 71.57% of pool value. J+1 removed a further 29.10% of what remained. The extraction lasted 17.4 seconds; the withdrawal it triggered lasted two days.

Total value locked is a stock measure in USD. It does not by itself establish a net outflow of assets, and it should not be read as a second loss figure alongside the $9.05M. The decline may combine withdrawals, asset price movement, and the removal of the borrowed principal; these components are not separable from the published seriesUNRESOLVED

Figure 3 · The protocol was mispriced for 153 times longer than it was being drained. Intervals from section 03, plotted on log10(seconds). FC-DERIVED

The headline figure reconciles to within $78.43, consistent with rounding to the nearest $10,000. Prices are Bonzo's stated reference prices at the time of the draws, not marks at any other block.

Collateral value. At the restored rate of 0.1964 HBAR per SAUCE and $0.06998 per HBAR, 250 SAUCE computes to $3.44FC-DERIVED This is an illustrative approximation, not a mark-to-market at the deposit block: the SAUCE reference used is the post-incident restored price, and no price at the deposit block has been publishedUNRESOLVED On that basis the collateral-to-credit ratio is on the order of 2.6 million to one.

FC-046 is classified FC-CLASS-003 — oracle price manipulation — on the criterion that the exploit path runs through a price value consumed by the protocol. It is one of 7 cases in that family, spanning 2019 to 2026.

Seven cases is enough to stop calling this a category of accident and start calling it a mechanism. Every case in the family asks the same question: what did the protocol do when the number it was handed made no sense?

Here, nothing. Because no one had written down what an impossible number looks like.

The oldest case in this family is from 2019. The failure mode has not changed since. What has changed is the size of the positions standing on top of it.

Two conditions hold across all seven, without a single exception: the protocol consumed an external price it did not control, and that value was corrupted before consumption. What differs is the how — six distinct defect types across seven cases. The largest is 32 times the smallest with a recorded loss. This one is the only instance where the corruption passed through a signature verifier rather than through the market or the feed itself. By loss, it sits fourth.

Three of the four charts this report could have drawn are drawn above. The fourth is the one that needs the other six cases: where a given loss sits in the family's distribution, and which guard was missing in how many of them. That one is not a chart about Bonzo.

Because the pattern across the seven is not that the oracle broke. It is which control was absent on the consuming side when it did — and that recurs with a regularity that a single case cannot show and cannot prove.

Which leaves the question this report does not answer. Not how Bonzo failed — that is above, in full. But whether the same missing control sits in your own dependency chain, and what it has cost the seven protocols that found out the hard way.