BonqDAO hack — February 2023

On 1 February 2023, at around 18:30 CET, the Polygon-based borrowing protocol BonqDAO was drained through manipulation of the Tellor price oracle it used for wrapped AllianceBlock (wALBT) collateral. Tellor's reporting is permissionless: anyone staking the minimum amount of TRB can submit a price. Because BonqDAO used the most recent submitted value with no delay or averaging, a submitted price took effect immediately.

The attacker submitted a hugely inflated wALBT price, opened a trove backed by a fraction of a token and minted roughly 100 million BEUR, BonqDAO's euro stablecoin. Minutes later they submitted a near-zero price, which pushed existing troves under water and let them liquidate around 113 million wALBT. Immunefi's analysis found the attacker deployed a fresh contract for each price submission in order to bypass Tellor's reporting timelock.

The headline numbers are notional. The roughly $120 million figure given in Immunefi's analysis, and the $88 million reported by The Block, value the minted BEUR and seized wALBT at pre-attack prices, and neither could be realised because the tokens had almost no liquidity. The Block reported the attacker sold roughly $1.2 million before liquidity ran out. AllianceBlock's founder said the actual damage involving ALBT was closer to $1.6 million than the amounts previously reported. CoinDesk described it as an exploit of about $5 million. This entry uses AllianceBlock's own accounting as the best estimate and records the full published spread as the bounds.

AllianceBlock paused its bridge, withdrew liquidity from exchanges and pools and asked venues to halt ALBT trading. It said it was developing a solution involving minting a new ALBT token and airdropping it to addresses holding legacy ALBT balances. No arrests have been reported.