BonqDAO Hack

Reported affected value $1.8M
Polygon
Manipulated collateral price

What happened

On February 1, 2023, BonqDAO’s Polygon lending market accepted manipulated WALBT oracle prices. An attacker first inflated the price to borrow excessive BEUR, then lowered it to liquidate other borrowers. The often-cited $120 million measures affected token value, not demonstrated cash proceeds.

Technical root cause

BonqDAO treated the latest reporter submission as a usable spot price without sufficient protection against manipulation.

How it happened

  1. The attacker met Tellor’s reporting requirements and submitted an inflated WALBT value.
  2. BonqDAO consumed the latest reported value, allowing excessive BEUR borrowing against modest collateral.
  3. A second low price pushed WALBT-backed troves into liquidation.
  4. The attacker liquidated over 30 troves and collected approximately 113 million WALBT.

Protocol details

Classification Oracle Manipulation
Protocol Type Lending
Affected asset / contract BNQ
Implementation language Solidity
Protocol links Website @BonqDAO

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Oracle Manipulation & Price Manipulation

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes