Lack of liquidity mitigated damages to BonqDAO exploit: Report

After amassing $120 million in tokens through an infinite minting glitch, hackers reportedly only cashed out around $1 million due to a lack of liquidity on BonqDAO.

According to blockchain security firm CertiK, the damage caused to decentralized protocol BonqDAO on Feb. 1 may have been much less than initially thought. 

As told by CertiK, the attacker first borrowed 100 million BEUR, a euro stablecoin, with less than $1,000 in collateral due to a lack of controls on the collateralization ratio. If users set the parameter to zero, then the platform defaults to returning the “maximum value of uint256,” allowing an astronomical sum of loans to be issued.

However, CertiK said that despite the attacker borrowing 100 million BEUR (around $120 million at the time of attack), the hacker only managed to withdraw around $1 million due to a lack of liquidity on the platform. Previously, blockchain security firms such as PeckSheild stated that around $120 million was lost during the attack.

Bonq is a fork of Liquity Protocol, which, similar to that blockchain, uses Troves to represent isolated debt positions. However, Bonq reportedly implemented a Community Liquidation Feature where 45 Troves with BEUR exposure were liquidated due to the incident. According to CertiK, the attack also impacted Troves containing approximately 110 million Alliance Block tokens (ALBT). That said, none of the Alliance Block smart contracts were breached during the incident, and the project has said it will airdrop new tokens to compensate affected holders.

Bonq protocol was exposed to an oracle hack, where exploiter increased the ALBT price and minted large amounts of BEUR. The BEUR was then swapped for other tokens on Uniswap. Then, the price was decreased to almost zero, which triggered the liquidation of ALBT troves.

— BonqDAO (@BonqDAO) February 1, 2023

Although a lack of liquidity appears to have mitigated damages to BonqDAO during the incidents, others were not so lucky. On Oct. 12, DeFi protocol Mango Markets initially lost $116 million after hacker Avraham Eisenberg manipulated the price of the MNGO token price, driving it up 30 times via enormous perpetual future contracts within a short period. This was possible as a relatively small initial capital was required to manipulate MNGO due to low liquidity. 

Related: How low liquidity led to Mango Markets losing over $116 million

Afterward, Eisenberg acquired a loan for $116 million using $423 million of his inflated MNGO holdings as collateral and siphoned funds from the platform. On Dec. 28, Eisenberg was arrested in Puerto Rico on charges of commodities manipulation and commodities fraud.