BonqDAO Protocol Oracle Hack - Revision history

Azoundria: Another 30 minutes complete.

2023-05-31T20:13:20Z

Another 30 minutes complete.

Azoundria at 19:46, 31 May 2023

2023-05-31T19:46:29Z

← Older revision		Revision as of 13:46, 31 May 2023
Line 1:		Line 1:
	[[File:Bonqdao.jpg\|thumb\|BonqDAO]]~~{{Case Study Under Construction}}~~		{{Case Study Under Construction}}
			[[File:Bonqdao.jpg\|thumb\|BonqDAO]]
	Bonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collateralized, low volatility payment coin to allow users to borrow against their whitelisted crypto assets at a zero interest rate. Omniscia’s audit of BonqDAO raised concerns over “multiple vulnerabilities as well as core design flaws”. An anonymous attacker was able to manipulate the Tellor price feed to their advantage and siphon off funds amounting to approximately $120M, although they managed to steal less than $2M. The attacker deposited 10 TRB to call the depositStake function of the TellorFlex contract and stake 0.1 $WALBT to the trove contract to borrow 100M $BEUR by artificially inflating the price of WALBT. The damage to BonqDAO was brutal, with TVL drained from ~$13M to just over $100k at the time of writing. Stolen BEUR was dumped on Polygon for just over $500K. The attacker’s ETH address currently holds 711 ETH ($1.2M) and 535k DAI, as well as 89M ALBT.		Bonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collateralized, low volatility payment coin to allow users to borrow against their whitelisted crypto assets at a zero interest rate. Omniscia’s audit of BonqDAO raised concerns over “multiple vulnerabilities as well as core design flaws”. An anonymous attacker was able to manipulate the Tellor price feed to their advantage and siphon off funds amounting to approximately $120M, although they managed to steal less than $2M. The attacker deposited 10 TRB to call the depositStake function of the TellorFlex contract and stake 0.1 $WALBT to the trove contract to borrow 100M $BEUR by artificially inflating the price of WALBT. The damage to BonqDAO was brutal, with TVL drained from ~$13M to just over $100k at the time of writing. Stolen BEUR was dumped on Polygon for just over $500K. The attacker’s ETH address currently holds 711 ETH ($1.2M) and 535k DAI, as well as 89M ALBT.

Azoundria: Testing save

2023-05-31T19:45:52Z

Testing save

← Older revision		Revision as of 13:45, 31 May 2023
Line 1:		Line 1:
	~~{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/bonqdaoprotocoloraclehack.php}}~~		[[File:Bonqdao.jpg\|thumb\|BonqDAO]]{{Case Study Under Construction}}
	~~{{Unattributed Sources}}~~		Bonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collateralized, low volatility payment coin to allow users to borrow against their whitelisted crypto assets at a zero interest rate. Omniscia’s audit of BonqDAO raised concerns over “multiple vulnerabilities as well as core design flaws”. An anonymous attacker was able to manipulate the Tellor price feed to their advantage and siphon off funds amounting to approximately $120M, although they managed to steal less than $2M. The attacker deposited 10 TRB to call the depositStake function of the TellorFlex contract and stake 0.1 $WALBT to the trove contract to borrow 100M $BEUR by artificially inflating the price of WALBT. The damage to BonqDAO was brutal, with TVL drained from ~$13M to just over $100k at the time of writing. Stolen BEUR was dumped on Polygon for just over $500K. The attacker’s ETH address currently holds 711 ETH ($1.2M) and 535k DAI, as well as 89M ALBT.

	[[File:Bonqdao.jpg\|thumb\|BonqDAO]]Bonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collateralized, low volatility payment coin to allow users to borrow against their whitelisted crypto assets at a zero interest rate. Omniscia’s audit of BonqDAO raised concerns over “multiple vulnerabilities as well as core design flaws”. An anonymous attacker was able to manipulate the Tellor price feed to their advantage and siphon off funds amounting to approximately $120M, although they managed to steal less than $2M. The attacker deposited 10 TRB to call the depositStake function of the TellorFlex contract and stake 0.1 $WALBT to the trove contract to borrow 100M $BEUR by artificially inflating the price of WALBT. The damage to BonqDAO was brutal, with TVL drained from ~$13M to just over $100k at the time of writing. Stolen BEUR was dumped on Polygon for just over $500K. The attacker’s ETH address currently holds 711 ETH ($1.2M) and 535k DAI, as well as 89M ALBT.

	~~This is a global/international case not involving a specific country.<ref name="rektnews-10881" /><ref name="polygonscan-10882" /><ref name="polygonscan-10883" />~~

	== About BonqDAO ==		== About BonqDAO ==
Line 111:		Line 107:
	\|February 1st, 2023 11:29:18 AM MST		\|February 1st, 2023 11:29:18 AM MST
	\|Malicious Transaction		\|Malicious Transaction
	\|The malicious transaction occurs on the blockchain.		\|The malicious transaction occurs on the blockchain<ref name="polygonscan-10882" /><ref name="polygonscan-10883" />.
	\|-		\|-
	\|February 1st, 2023 12:17:00 PM MST		\|February 1st, 2023 12:17:00 PM MST
Line 128:		Line 124:
	\|MetaSleuth Analysis Update		\|MetaSleuth Analysis Update
	\|The MetaSleuth analysis is updated to report that the exploiter has swapped their DAI for Ether and is sending those funds through TornadoCash<ref>[https://twitter.com/MetaSleuth/status/1621448225654964225 MetaSleuth - "The @BonqDAO attacker has swapped DAI for Ether and laundered 1,105 Ether via Tornado Cash." - Twitter] (May 4, 2023)</ref><ref>[https://metasleuth.io/result/eth/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642?source=0c69e957-3d14-458f-a5df-5f177d1deb0b MetaSleuth Analysis On TornadoCash Exiting] (May 4, 2023)</ref>.		\|The MetaSleuth analysis is updated to report that the exploiter has swapped their DAI for Ether and is sending those funds through TornadoCash<ref>[https://twitter.com/MetaSleuth/status/1621448225654964225 MetaSleuth - "The @BonqDAO attacker has swapped DAI for Ether and laundered 1,105 Ether via Tornado Cash." - Twitter] (May 4, 2023)</ref><ref>[https://metasleuth.io/result/eth/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642?source=0c69e957-3d14-458f-a5df-5f177d1deb0b MetaSleuth Analysis On TornadoCash Exiting] (May 4, 2023)</ref>.
			\|-
			\|February 7th, 2023 2:18:00 AM MST
			\|Rekt Article Published
			\|Rekt publishes an article on the Bonq exploit<ref>[https://twitter.com/RektHQ/status/1622887636875546625 RektHQ - "BonqDAO got bonked for $120M last week. But the anonymous attacker got away with less than $2M." - Twitter] (May 31, 2023)</ref>. <ref name="rektnews-10881" />
	\|}		\|}

Line 168:		Line 168:
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	{{Prevention:~~Individuals~~:~~Placeholder~~}}		{{Prevention:Individual:Avoid Using Smart Contracts}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Regular Audit Procedures}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Platform Security Assessments}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}
Line 185:		Line 185:
	<references>		<references>
	<ref name="rektnews-10881">[https://rekt.news/bonq-rekt/ Rekt - BonqDAO - REKT] (May 3, 2023)</ref>		<ref name="rektnews-10881">[https://rekt.news/bonq-rekt/ Rekt - BonqDAO - REKT] (May 3, 2023)</ref>
	<ref name="polygonscan-10882">[https://polygonscan.com/address/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 BonqDAO Exploiter ~~\| Address 0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 \|~~ PolygonScan] (May 3, 2023)</ref>		<ref name="polygonscan-10882">[https://polygonscan.com/address/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 BonqDAO Exploiter Wallet - PolygonScan] (May 3, 2023)</ref>
	<ref name="polygonscan-10883">[https://polygonscan.com/tx/0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19 ~~Polygon Transaction Hash (Txhash) Details \|~~ PolygonScan] (May 3, 2023)</ref>		<ref name="polygonscan-10883">[https://polygonscan.com/tx/0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19 Malicious Exploit of BonqDao - PolygonScan] (May 3, 2023)</ref>
	<ref name="beosinalerttwitter-10884">[https://twitter.com/BeosinAlert/status/1621095640486006787 BeosinAlert - "@BonqDAO and @allianceblock were under price manipulation attack earlier today, resulting in a $88M loss." - Twitter] (May 3, 2023)</ref>		<ref name="beosinalerttwitter-10884">[https://twitter.com/BeosinAlert/status/1621095640486006787 BeosinAlert - "@BonqDAO and @allianceblock were under price manipulation attack earlier today, resulting in a $88M loss." - Twitter] (May 3, 2023)</ref>
	<ref name="metasleuthtwitter-10885">[https://twitter.com/MetaSleuth/status/1621006016065474560 MetaSleuth - "The profit of @BonqDAO attacker is around 98.6M BEUR 113M WALBT. Specifically, 113M WALBT was burned to unlock 113M ALBT." - Twitter] (May 3, 2023)</ref>		<ref name="metasleuthtwitter-10885">[https://twitter.com/MetaSleuth/status/1621006016065474560 MetaSleuth - "The profit of @BonqDAO attacker is around 98.6M BEUR 113M WALBT. Specifically, 113M WALBT was burned to unlock 113M ALBT." - Twitter] (May 3, 2023)</ref>

Azoundria: Initial 30 minutes completed.

2023-05-04T06:14:19Z

Initial 30 minutes completed.

← Older revision		Revision as of 00:14, 4 May 2023
Line 4:		Line 4:
	[[File:Bonqdao.jpg\|thumb\|BonqDAO]]Bonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collateralized, low volatility payment coin to allow users to borrow against their whitelisted crypto assets at a zero interest rate. Omniscia’s audit of BonqDAO raised concerns over “multiple vulnerabilities as well as core design flaws”. An anonymous attacker was able to manipulate the Tellor price feed to their advantage and siphon off funds amounting to approximately $120M, although they managed to steal less than $2M. The attacker deposited 10 TRB to call the depositStake function of the TellorFlex contract and stake 0.1 $WALBT to the trove contract to borrow 100M $BEUR by artificially inflating the price of WALBT. The damage to BonqDAO was brutal, with TVL drained from ~$13M to just over $100k at the time of writing. Stolen BEUR was dumped on Polygon for just over $500K. The attacker’s ETH address currently holds 711 ETH ($1.2M) and 535k DAI, as well as 89M ALBT.		[[File:Bonqdao.jpg\|thumb\|BonqDAO]]Bonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collateralized, low volatility payment coin to allow users to borrow against their whitelisted crypto assets at a zero interest rate. Omniscia’s audit of BonqDAO raised concerns over “multiple vulnerabilities as well as core design flaws”. An anonymous attacker was able to manipulate the Tellor price feed to their advantage and siphon off funds amounting to approximately $120M, although they managed to steal less than $2M. The attacker deposited 10 TRB to call the depositStake function of the TellorFlex contract and stake 0.1 $WALBT to the trove contract to borrow 100M $BEUR by artificially inflating the price of WALBT. The damage to BonqDAO was brutal, with TVL drained from ~$13M to just over $100k at the time of writing. Stolen BEUR was dumped on Polygon for just over $500K. The attacker’s ETH address currently holds 711 ETH ($1.2M) and 535k DAI, as well as 89M ALBT.

	This is a global/international case not involving a specific country.<ref name="rektnews-10881" /><ref name="polygonscan-10882" /><ref name="polygonscan-10883~~" /><ref name="beosinalerttwitter-10884" /><ref name="metasleuthtwitter-10885" /><ref name="spreekawaytwitter-10886" /><ref name="bonqdao-10887" /><ref name="bonqdocs-10888~~" />		This is a global/international case not involving a specific country.<ref name="rektnews-10881" /><ref name="polygonscan-10882" /><ref name="polygonscan-10883" />

	== About BonqDAO ==		== About BonqDAO ==
			<ref name="bonqdao-10887" /><ref name="bonqdocs-10888" />

	Bonq DAO "We make self-sovereign finance a reality. With Bonq, businesses and individuals can access liquidity of their crypto assets without giving up ownership and completely interest-free!"		Bonq DAO "We make self-sovereign finance a reality. With Bonq, businesses and individuals can access liquidity of their crypto assets without giving up ownership and completely interest-free!"

Line 110:		Line 112:
	\|Malicious Transaction		\|Malicious Transaction
	\|The malicious transaction occurs on the blockchain.		\|The malicious transaction occurs on the blockchain.
			\|-
			\|February 1st, 2023 12:17:00 PM MST
			\|Report By Spreekaway
			\|Twitter user Spreekaway was the first to report on the exploit on Twitter<ref name="spreekawaytwitter-10886" />.
			\|-
			\|February 1st, 2023 9:42:00 PM MST
			\|MetaSleuth Blockchain Analysis
			\|Twitter user MetaSleuth (part of the BlockSecTeam) reports an analysis of the path of the exploited funds<ref name="metasleuthtwitter-10885" /><ref>[https://metasleuth.io/result/polygon/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642?source=366a8ae3-b0c6-42f9-9932-d05fe599dd12 MetaSleuth Fund Path Analysis] (May 4, 2023)</ref>.
			\|-
			\|February 2nd, 2023 3:38:00 AM MST
			\|Beosin Alert Analysis Posted
			\|<ref name="beosinalerttwitter-10884" />. TBD
			\|-
			\|February 3rd, 2023 2:59:00 AM MST
			\|MetaSleuth Analysis Update
			\|The MetaSleuth analysis is updated to report that the exploiter has swapped their DAI for Ether and is sending those funds through TornadoCash<ref>[https://twitter.com/MetaSleuth/status/1621448225654964225 MetaSleuth - "The @BonqDAO attacker has swapped DAI for Ether and laundered 1,105 Ether via Tornado Cash." - Twitter] (May 4, 2023)</ref><ref>[https://metasleuth.io/result/eth/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642?source=0c69e957-3d14-458f-a5df-5f177d1deb0b MetaSleuth Analysis On TornadoCash Exiting] (May 4, 2023)</ref>.
	\|}		\|}

	== Technical Details ==		== Technical Details ==
	This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?		This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

			=== MetaSleuth (BlockSecTeam) Analysis ===
			<blockquote>1/ The profit of @BonqDAO attacker is around 98.6M BEUR 113M WALBT. Specifically, 113M WALBT was burned to unlock 113M ALBT. ~0.5M BEUR was swapped to 534,535 USDC and t to Ethereum (0xcacf…6642). 98.1M BEUR was still on the attacker’s account on Polygon.

			2/ For 0xcacf..6642 on Ethereum, it s[w]apped the received USDC to DAI using 0xExchange(@0xproject). Also, WALBT is swapping into ETH/USDT using 0xExchange and Uniswap. The account currently holds 711 ETH, 534,481 DAI, and 89M ALBT.

			3/ Update： The @BonqDAO attacker has swapped DAI for Ether and laundered 1,105 Ether via Tornado Cash.</blockquote>

	== Total Amount Lost ==		== Total Amount Lost ==
Line 125:		Line 150:
	== Ultimate Outcome ==		== Ultimate Outcome ==
	What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?		What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

			=== Bonq Protocol Documentation Update ===
			<ref name="bonqdocs-10888" /><ref>[https://mirror.xyz/bonqdaoblog.eth/Mq4qgNieUi-ytphYzPU-lWY_E1J2F7STq_xlCR3qGsE Hack Report - BonqDAO] (May 4, 2023)</ref><ref>[https://mirror.xyz/bonqdaoblog.eth/8z7vD3nmfPhe-cwxNvVQKOuD1IkfBbP3dicjw_1SDRw Bonq 2.0 Reboot/Recovery Proposal] (May 4, 2023)</ref><blockquote>'''On Feb 1st, 2023 Bonq protocol was exposed to oracle hack'''

			Protocol is at the moment paused. Recommended course of actions is, to visit Bonq app and withdraw any available Trove collaterals. Bonq repaid all debts on the remaining troves, so collaterals can be withdrawn! Any other actions, that are not officially communicated, please withhold on them.

			Hack report Bonq 2.0 recovery/reboot proposal

			Please bear with us and thank you for your understanding.</blockquote>

	== Total Amount Recovered ==		== Total Amount Recovered ==
Line 149:		Line 183:

	== References ==		== References ==
	<references><ref name="rektnews-10881">[https://rekt.news/bonq-rekt/ Rekt - BonqDAO - REKT] (May 3, 2023)</ref>		<references>
			<ref name="rektnews-10881">[https://rekt.news/bonq-rekt/ Rekt - BonqDAO - REKT] (May 3, 2023)</ref>
	<ref name="polygonscan-10882">[https://polygonscan.com/address/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 BonqDAO Exploiter \| Address 0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 \| PolygonScan] (May 3, 2023)</ref>		<ref name="polygonscan-10882">[https://polygonscan.com/address/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 BonqDAO Exploiter \| Address 0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 \| PolygonScan] (May 3, 2023)</ref>

	<ref name="polygonscan-10883">[https://polygonscan.com/tx/0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19 Polygon Transaction Hash (Txhash) Details \| PolygonScan] (May 3, 2023)</ref>		<ref name="polygonscan-10883">[https://polygonscan.com/tx/0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19 Polygon Transaction Hash (Txhash) Details \| PolygonScan] (May 3, 2023)</ref>
			<ref name="beosinalerttwitter-10884">[https://twitter.com/BeosinAlert/status/1621095640486006787 BeosinAlert - "@BonqDAO and @allianceblock were under price manipulation attack earlier today, resulting in a $88M loss." - Twitter] (May 3, 2023)</ref>
	<ref name="beosinalerttwitter-10884">[https://twitter.com/BeosinAlert/status/1621095640486006787 @~~BeosinAlert~~ Twitter] (May 3, 2023)</ref>		<ref name="metasleuthtwitter-10885">[https://twitter.com/MetaSleuth/status/1621006016065474560 MetaSleuth - "The profit of @BonqDAO attacker is around 98.6M BEUR 113M WALBT. Specifically, 113M WALBT was burned to unlock 113M ALBT." - Twitter] (May 3, 2023)</ref>
			<ref name="spreekawaytwitter-10886">[https://twitter.com/spreekaway/status/1620864016741732353 spreekaway - "seems that @BonqDAO and @allianceblock has been exploited and large amounts of BEUR and ALBT tokens tokens have been stolen." Twitter] (May 3, 2023)</ref>
	<ref name="metasleuthtwitter-10885">[https://twitter.com/MetaSleuth/status/1621006016065474560 @~~MetaSleuth~~ Twitter] (May 3, 2023)</ref>

	<ref name="spreekawaytwitter-10886">[https://twitter.com/spreekaway/status/1620864016741732353 @~~spreekaway~~ Twitter] (May 3, 2023)</ref>

	<ref name="bonqdao-10887">[https://bonqdao.com/ BonqDAO - Self-sovereign finance] (May 3, 2023)</ref>		<ref name="bonqdao-10887">[https://bonqdao.com/ BonqDAO - Self-sovereign finance] (May 3, 2023)</ref>
			<ref name="bonqdocs-10888">[https://bonq-docs.gitbook.io/protocol-overview/protocol-documentation/welcome-to-bonq Welcome to Bonq - Protocol Overview] (May 3, 2023)</ref>
	<ref name="bonqdocs-10888">[https://bonq-docs.gitbook.io/protocol-overview/protocol-documentation/welcome-to-bonq Welcome to Bonq - Protocol Overview] (May 3, 2023)</ref></references>		</references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bonqdaoprotocoloraclehack.php}} {{Unattributed Sources}} BonqDAOBonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collaterali..."

2023-05-04T05:58:07Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bonqdaoprotocoloraclehack.php}} {{Unattributed Sources}} thumb|BonqDAOBonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collaterali..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/bonqdaoprotocoloraclehack.php}}
{{Unattributed Sources}}

[[File:Bonqdao.jpg|thumb|BonqDAO]]Bonq DAO is a non-custodial, decentralized, and over-collateralized lending platform that allows users to borrow against their own tokens at zero interest rate. It also creates a deep liquidity solution without incentivizing or paying the other side of the liquidity pool. BonqDAO uses the BEUR, a collateralized, low volatility payment coin to allow users to borrow against their whitelisted crypto assets at a zero interest rate. Omniscia’s audit of BonqDAO raised concerns over “multiple vulnerabilities as well as core design flaws”. An anonymous attacker was able to manipulate the Tellor price feed to their advantage and siphon off funds amounting to approximately $120M, although they managed to steal less than $2M. The attacker deposited 10 TRB to call the depositStake function of the TellorFlex contract and stake 0.1 $WALBT to the trove contract to borrow 100M $BEUR by artificially inflating the price of WALBT. The damage to BonqDAO was brutal, with TVL drained from ~$13M to just over $100k at the time of writing. Stolen BEUR was dumped on Polygon for just over $500K. The attacker’s ETH address currently holds 711 ETH ($1.2M) and 535k DAI, as well as 89M ALBT.

This is a global/international case not involving a specific country.<ref name="rektnews-10881" /><ref name="polygonscan-10882" /><ref name="polygonscan-10883" /><ref name="beosinalerttwitter-10884" /><ref name="metasleuthtwitter-10885" /><ref name="spreekawaytwitter-10886" /><ref name="bonqdao-10887" /><ref name="bonqdocs-10888" />

== About BonqDAO ==
Bonq DAO "We make self-sovereign finance a reality. With Bonq, businesses and individuals can access liquidity of their crypto assets without giving up ownership and completely interest-free!"

"List your token on Bonq once and never worry about liquidity again. Token holders can borrow against their whitelisted crypto assets at ZERO interest rate and own their liquidity."

"On-chain, non-custodial and decentralized liquidity protocol that uses a collateralized, low volatility payment coin (BEUR).
Users can borrow BEUR against their whitelisted crypto assets at ZERO interest rate and own their liquidity."

"Bonq is a non-custodial, decentralized and over-collateralized lending platform that solves four critical problems for projects and protocols that have a token: Allows them to borrow against their own tokens at zero interest rate. Creates deep liquidity solution without the need to incentivize or pay the other side of the liquidity pool. Offers sustainable yields to their community members holding tokens in a safe and secure environment. Allows Treasuries to de-risk and create a smart capital allocation."

"Omniscia’s audit of BonqDAO raised concerns over “multiple vulnerabilities as well as core design flaws”.

According to Omniscia's post-mortem, BonqDAO decided to:

not move forward with the implementations audited at the time, opting to integrate Chainlink oracles in the future.

The Bonq Protocol has introduced numerous updates since the time the audit was finalized, including all contracts involved in the vulnerability (ConvertedPriceFeed, ChainlinkPriceFeed, and TellorPriceFeed). These contracts were never in scope of any audit conducted by the Omniscia team and thus are considered to be unaudited code."

"The Polygon-based lending and stablecoin protocol was hit by a two-stage attack on Wednesday in another example oracle manipulation."

"@BonqDAO got bonked for $120M last week.

But the anonymous attacker got away with less than $2M."

"Despite all the action being visible on-chain, BonqDAO telegram admins attempted to downplay the incident whilst the team presumably worked out what had happened."

"Samczsun summarised the attack as follows:

the attacker said "btw 1 ALBT = 5 billion MATIC now" and Bonq said "ok"

The hacker was able to manually update the Tellor price feed of (wrapped) WALBT collateral by staking 10 TRB tokens (worth just ~$175).

The attacker then used the submitValue function to report WALBT price to the oracle and, because BonqDAO uses the instant value, the attaker was able to borrow against their inflated collateral within the same tx.

Firstly, the ALBT price was raised, allowing the attacker to mint 100M BEUR, Bonq’s Euro-pegged stablecoin against 0.1 WALBT collateral.

Then, in a subsequent transaction, the WALBT price was reset to extremely low, allowing the attacker to liquidate user’s WALBT collateral, and netting approximately 113M WALBT."

"The attacker calls the depositStake function of the TellorFlex contract, depositing 10 $TRB. Why 10 TRBs? We can see that the takeAmount is exactly 10*10^18

Next, the hacker calls the submitValue function to submit a request to change the $WALBT price. The function determines if the caller's stake amount has reached the pre-set takeAmount, which is why the attacker needs to first stake 10 TRB tokens (10^18 is decimal point).

This function will record the price submitted by the caller, in this case 50000000000000000000000000000000.

After the price is set, the hacker calls the createTrove function of the Bonq contract to create the trove(0x4248FD) contract, which is a contract of data recording, borrowing and liquidating. Next, the attacker stakes 0.1 $WALBT to the contract to perform a borrowing operation.

Normally, the borrowing amount should be < 0.1 WALBT to ensure collateral rate in a safe range. But in this contract, the calculation of the collateral value is via TellorFlex contract. The attacker has already raised $WALBT price, thus being able to borrow 100M $BEUR.

The hacker sets $WALBT to a low price in 2nd TX. When the $WALBT price is extremely low, the stake rate of WALBTs staked by other users will be at liquidation, enabling hacker to liquidate $WALBT staked by other users at low cost, eventually obtaining ~114M WALBT."

"Losses have been widely reported to be up to $120M, using the tokens’ prices at the time of the hack. But low liquidity meant the attacker has only managed to swap the loot to around $1.7M worth of ETH and DAI, so far.

Nevertheless, the damage to BonqDAO was brutal, with TVL drained from ~$13M yesterday to just over $100k at the time of writing."

"Stolen BEUR was dumped on Polygon for just over $500K. Funds were then sent to the attacker’s Ethereum address, where the ALBT was repeatedly dumped for ETH. The attacker’s ETH address currently holds 711 ETH (~$1.2M) and 535k DAI, as well as 89M ALBT (supposedly worth ~$3M, if the attacker can find somewhere to sell it…)."

"BlockSec provided a detailed flowchart of funds, which can be found here. The attacker’s ETH address was funded via Tornado Cash shortly before the attack, and the stolen funds have since been deposited back into the mixer."

"While it may have been BonqDAO had the vulnerability, AllianceBlock has suffered significant collateral damage from this incident.

The sell-off of Bonq users' liquidated ALBT caused its price to dump up to ~75% following the attack. AllianceBlock have stated they will reissue the token and airdrop to users based on a Snapshot from before the hack.

Bonq’s Euro stablecoin, BEUR, has dropped to approximately 25% below its peg and the price of the DAO’s token, BNQ, has also taken a hit of over 30%.

AllianceBlock may not be at fault for the vulnerability, but perhaps they need to work on their due diligence."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - BonqDAO Protocol Oracle Hack
!Date
!Event
!Description
|-
|February 1st, 2023 11:29:18 AM MST
|Malicious Transaction
|The malicious transaction occurs on the blockchain.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $120,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="rektnews-10881">[https://rekt.news/bonq-rekt/ Rekt - BonqDAO - REKT] (May 3, 2023)</ref>

<ref name="polygonscan-10882">[https://polygonscan.com/address/0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 BonqDAO Exploiter | Address 0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642 | PolygonScan] (May 3, 2023)</ref>

<ref name="polygonscan-10883">[https://polygonscan.com/tx/0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19 Polygon Transaction Hash (Txhash) Details | PolygonScan] (May 3, 2023)</ref>

<ref name="beosinalerttwitter-10884">[https://twitter.com/BeosinAlert/status/1621095640486006787 @BeosinAlert Twitter] (May 3, 2023)</ref>

<ref name="metasleuthtwitter-10885">[https://twitter.com/MetaSleuth/status/1621006016065474560 @MetaSleuth Twitter] (May 3, 2023)</ref>

<ref name="spreekawaytwitter-10886">[https://twitter.com/spreekaway/status/1620864016741732353 @spreekaway Twitter] (May 3, 2023)</ref>

<ref name="bonqdao-10887">[https://bonqdao.com/ BonqDAO - Self-sovereign finance] (May 3, 2023)</ref>

<ref name="bonqdocs-10888">[https://bonq-docs.gitbook.io/protocol-overview/protocol-documentation/welcome-to-bonq Welcome to Bonq - Protocol Overview] (May 3, 2023)</ref></references>