Cowrie Research

helio-protocol-abnbc-stale-bnb-oracle-bad-debt-exploit-2022-12-02

14 min read

Helio Protocol aBNBc Stale-BNB-Oracle Bad-Debt Exploit (2022-12-02)

  • Name: Helio Protocol aBNBc stale-BNB-oracle bad-debt exploit
  • Date: 2022-12-02
  • Protocol: Helio Protocol / HAY stablecoin
  • Chain: BNB Chain
  • Category: stale-price exploitation / wrapped-collateral identity failure / upstream-token-compromise contagion / stablecoin bad debt
  • Loss: about $15.5M was extracted through the main borrow-and-dump path; Helio later reported total protocol bad debt of 19,046,819 HAY across the broader incident
  • Summary: Hours after Ankr’s aBNBc upgrade-key compromise made the liquid-staking receipt token effectively attacker-mintable and crashed its market price by about 99%, a second attacker used Helio as the downstream cash-out venue. They spent only 10 BNB to buy about 183,884.918 aBNBc, then routed that depegged wrapper into Helio’s BNB-denominated collateral path. Helio’s oracle logic still treated the collateral as if BNB parity held because Chainlink was monitoring BNB, not the now-broken aBNBc wrapper. With that stale collateral truth still live, the attacker borrowed 16M HAY in transaction 0x391a665e8efad14cd63d5caed10f53881ebb8eab1c5ae14648db2d06cdd00cdd, dumped about 15.5M HAY for BUSD through Wombat in transaction 0x9b4d0eb8df95ac6d5548c6abed0e90ceccebcf2560ef41bdc514d74746c0dd8e, and left Helio with system-wide bad debt that later totaled about 19.05M HAY.
  • Trigger / entry point:
    • Ankr’s upstream aBNBc compromise had already destroyed the wrapper’s supply integrity and market price before the Helio leg began.
    • Helio still allowed the attacker to use cheap aBNBc inside its collateral flow even though the wrapper no longer tracked BNB economically.
    • Helio’s collateral oracle relied on Chainlink’s BNB pricing rather than an independent live price for aBNBc, and Helio itself later said Chainlink did not support direct aBNBc monitoring.
    • Public incident writeups also noted that the attacker could bypass the Helio front-end UI and interact with contracts directly, so any UI-side restriction on the path was not a real onchain boundary.
  • Root cause:
    • Helio treated a compromised wrapped asset as if it still inherited the solvency meaning of its underlying asset.
    • The protocol’s oracle boundary failed open: once aBNBc stopped behaving like BNB, Helio still priced it through BNB assumptions and kept minting / borrowing paths open.
    • The deeper failure was not ordinary market volatility. An upstream privileged-upgrade incident had already broken the wrapper’s authenticity, but Helio’s collateral system had no fast way to de-recognize that wrapper before borrowers monetized the stale mark.
    • The front end was not the security boundary. Direct contract access meant any offchain or UI-level intent not to support the path was irrelevant once onchain collateral logic still honored it.
  • Exploit path:
    1. Ankr’s aBNBc exploit inflated wrapper supply and collapsed aBNBc market price to a tiny fraction of BNB parity.
    2. In transaction 0xaab2611b70f69cf79324c9bc5d0fcda5c95cabf713c74901a9613f212043dfc3, the Helio attacker spent 10 BNB through 1inch to buy about 183,884.918118284222488297 aBNBc.
    3. They routed that cheap aBNBc into Helio’s collateral flow, receiving roughly 191,130 hBNB of protocol-recognized collateral credit according to public incident analysis.
    4. Because Helio still treated the wrapper through BNB oracle truth, the attacker borrowed 16M HAY in transaction 0x391a665e8efad14cd63d5caed10f53881ebb8eab1c5ae14648db2d06cdd00cdd.
    5. In transaction 0x9b4d0eb8df95ac6d5548c6abed0e90ceccebcf2560ef41bdc514d74746c0dd8e, they swapped about 15.5M HAY into BUSD through Wombat’s HAY/BUSD liquidity, dragging HAY off peg and converting bad collateral into realizable stablecoin value.
    6. The BUSD proceeds were then dispersed across several transfers, with public writeups highlighting address 0x4c7f5513894a99260bbfcf88311b544d6ca12757 as a key recipient.
    7. Helio later said several smaller arbitrageurs copied the same opportunity, which is why total bad debt rose beyond the main 15.5M extraction path to 19,046,819 HAY.
  • What the attacker needed to be true:
    • The upstream aBNBc compromise had to happen first, so the attacker could source large nominal wrapper balances for almost no economic cost.
    • Helio needed to keep treating aBNBc as BNB-equivalent collateral long enough for one borrow-and-dump cycle to clear.
    • The protocol’s oracle path had to keep underwriting collateral from stale or semantically wrong price truth rather than quarantining the wrapper when parity broke.
    • There had to be enough HAY mint / borrow capacity and HAY/BUSD exit liquidity to monetize the false collateral immediately.
    • Direct contract access had to remain open so the attacker could avoid any front-end restrictions.
  • Technical anatomy worth remembering:
    • Helio was not exploited because Chainlink published a fake BNB price. The downstream protocol instead asked the wrong question: it kept asking what BNB was worth after aBNBc had stopped being trustworthy BNB-equivalent collateral.
    • This is a strong contagion case where one protocol’s privileged-upgrade failure became another protocol’s stale-price lending exploit. The important system boundary was not just Helio’s oracle, but whether Helio could revoke a wrapper once upstream issuance integrity failed.
    • The stablecoin leg matters. Helio did not merely overvalue bad collateral on paper; it turned that paper value into newly borrowed HAY, and the attacker then used Wombat liquidity to export the damage into dollar-like assets and an immediate depeg.
    • The UI-bypass detail is worth preserving because it keeps the incident from being misread as a front-end bug. The real failure was onchain collateral recognition, not website access control.
  • Representative transactions and addresses:
    • Cheap aBNBc purchase tx: 0xaab2611b70f69cf79324c9bc5d0fcda5c95cabf713c74901a9613f212043dfc3
    • Main HAY borrow tx: 0x391a665e8efad14cd63d5caed10f53881ebb8eab1c5ae14648db2d06cdd00cdd
    • Main HAY -> BUSD dump tx: 0x9b4d0eb8df95ac6d5548c6abed0e90ceccebcf2560ef41bdc514d74746c0dd8e
    • Publicly highlighted proceeds address: 0x4c7f5513894a99260bbfcf88311b544d6ca12757
    • Helio bad-debt burn address later used for remediation visibility: 0x192D4e2E19A01e49b30Fb3894A01B6e08947d9CA
  • Response / mitigation:
    • Helio said it immediately paused protocol functions once the issue was recognized.
    • The team began buying back HAY, saying the first wave removed about 6.8M HAY from the market while they worked to stabilize the peg.
    • Helio also said it would replace aBNBc collateral with the new ankrBNB wrapper and tighten security assumptions around that migration.
    • Public follow-up messaging from Helio and third-party trackers centered on bad-debt repayment, burn-address transparency, and re-pegging HAY after the exploit-induced depeg.

Three wrapper-and-collateral promotions this incident collapsed

  1. A broken wrapper still existed as a collateral-shaped object inside the system

    • After the Ankr compromise, aBNBc still looked like a depositable receipt token onchain even though its supply integrity and market meaning had already failed.
    • The first dangerous promotion was not yet borrow 16M HAY; it was that a counterfeit-mintable wrapper could still arrive at Helio’s collateral boundary looking enough like yesterday’s asset to enter the path at all.

  2. That surviving wrapper object was still promoted into canonical BNB-equivalent collateral truth

    • Helio’s own writeup said the protocol was monitoring BNB, not aBNBc, so the system kept treating the wrapper as if a live BNB oracle still certified its solvency meaning.
    • In other words, Helio promoted this wrapper can still be posted here into this wrapper still deserves fresh BNB-equivalent collateral semantics, even though the upstream compromise had already broken the identity that made such inheritance safe.

  3. That accepted collateral truth still inherited live stablecoin-printing and reserve-exit authority

    • Once Helio still recognized the attacker-bought aBNBc as money-good collateral, the protocol let it mint about 16M HAY, and Wombat liquidity let that synthetic credit leave immediately as BUSD.
    • The decisive failure was therefore not only stale semantics at the oracle boundary, but that the stale semantics still carried ordinary balance-sheet power: fresh borrowing authority, immediate external exit liquidity, and later protocol-wide bad debt.

The durable lesson is that the wrapper still exists, the wrapper still deserves the old underlying price meaning, and that accepted meaning still deserves live credit authority are three different promotions. Helio failed all three during the same incident window.

Pattern tags

  • stale-price-exploitation
  • Upstream wrapper-integrity break became downstream stale-price credit because aBNBc stopped deserving BNB collateral semantics before Helio stopped lending against it
  • Live underlying feed, semantically dead wrapper: Chainlink’s BNB price kept updating, but Helio still treated a counterfeit-mintable receipt token as if fresh BNB price implied fresh aBNBc collateral truth
  • UI policy did not matter because direct contract access stayed open: any intended front-end restriction was weaker than the onchain collateral path that still honored aBNBc
  • Stablecoin export path turned wrapper misrecognition into immediate reserve loss: once 16M HAY was minted, Wombat liquidity converted the bad-collateral accounting error into realizable BUSD and a visible HAY depeg

Why the exploit worked

  • Helio’s own Dec. 2022 incident writeup states the critical semantic mismatch directly: the main arbitrageur bought depegged aBNBc cheaply, bypassed the front end, and minted HAY because Helio’s collateral path was pricing only BNB, not aBNBc. The exploit window therefore was not oracle published a fake BNB price; it was the protocol kept treating a broken wrapper as if it still inherited BNB's price meaning.
  • The Ankr incident had already destroyed the key assumption Helio needed. Once a privileged upgrade made aBNBc infinitely mintable and drained its market liquidity, the relevant question was no longer what is BNB worth? but does this wrapper still deserve BNB-equivalent collateral semantics at all? Helio continued answering that second question as if nothing upstream had changed.
  • The exploit also shows why front-end support and onchain support are separate security states. Helio said the attacker could bypass the UI, which means the economically real control surface was the contract-level collateral path, not any offchain intention to avoid or hide aBNBc minting.
  • Stablecoin systems make this failure harsher than a paper overvaluation alone. Helio did not merely mis-mark bad collateral inside an internal accounting view; it minted 16M HAY that could be dumped into Wombat’s HAY/BUSD liquidity immediately, exporting the wrapper-recognition mistake into reserve loss, peg damage, and later system-wide bad debt.
  • The preserved lesson is therefore slightly sharper than ordinary stale-feed handling: a protocol needs a way to say the underlying feed is still live, but this wrapper no longer deserves that feed's solvency meaning, and then shut off new credit before arbitrageurs can monetize the semantic gap.

Detection and audit pivots

  • Inventory every wrapper-specific condition that must remain true before an underlying feed may still underwrite collateral: mint authority, upgrade control, redemption path, bridge or staking semantics, supply integrity, and market liquidity. Helio shows that BNB feed still works is not a sufficient check for aBNBc still deserves BNB collateral meaning.
  • Treat upstream wrapper-integrity breaks as immediate downstream solvency events. A counterfeit-mint, depeg, or redemption failure should trigger asset-local collateral quarantine, borrow disablement, or semantic-price revocation faster than arbitrageurs can source the broken wrapper and route borrowed stablecoins out.
  • Audit whether front-end restrictions are actually mirrored onchain. If users can still reach the mint or borrow path by calling contracts directly, the UI is not the effective control surface during a live wrapper incident.
  • Compare wrapper market price and liquidity to the inherited underlying mark during stress, but ask the sharper question too: even if the underlying oracle is fresh, what exact evidence says this wrapper still deserves to inherit it?
  • Test stablecoin cash-out paths explicitly. For wrapper-collateral systems that mint a protocol stablecoin, the danger is not only overvalued collateral but how quickly bad credit can be exported through the deepest external pool before the wrapper is de-recognized.

Failure-prevention checklist

  • Define wrapper-specific collateral eligibility separately from underlying price freshness. A live BNB feed should never by itself certify that aBNBc still deserves BNB-equivalent borrow power.
  • Treat upgrade-key compromise, unauthorized minting, redemption failure, or large wrapper depegs as immediate collateral-derecognition events with asset-local borrow disablement and, where necessary, liquidation or mint-path pause authority.
  • Put onchain controls where the risk lives. If a wrapper is not meant to back minting during stress, the contract path itself must reject it; front-end hiding or offchain operator intent is not a security boundary.
  • Bind stablecoin mint limits and per-collateral caps to executable exit liquidity, especially for wrappers whose failure can be monetized instantly through one deep stable swap pool.
  • Maintain an emergency migration path for compromised wrappers that preserves user unwind options without letting the old asset retain fresh credit authority during the transition.
  • Predefine who can revoke inherited oracle semantics, what onchain toggles freeze the dangerous actions first, and what evidence is required before a replacement wrapper regains borrow-side authority.

Audit prompts

  • What exact condition lets this wrapper keep inheriting the underlying asset’s oracle meaning: supply integrity, redemption parity, bridge verifier health, upgrade-key safety, or merely historical convention?
  • If this wrapper becomes infinitely mintable or sharply depegs while the underlying feed remains healthy, what concrete onchain step stops new minting or borrowing first?
  • Can a user bypass the intended UI path and still post the wrapper as collateral or mint the protocol stablecoin directly?
  • How large a stablecoin position can be printed and dumped through the deepest external pool before any guardian, cap, or semantic-price revocation intervenes?
  • Is there a documented degraded mode for wrapper incidents that separates users may unwind or migrate from users may keep creating fresh protocol liabilities against this asset?
  • When the team replaces a broken wrapper with a successor asset, what proves the old wrapper’s credit authority is fully extinguished rather than merely hidden in the interface?

Lessons that should already be standard

  • A fresh underlying oracle does not rescue a wrapper whose issuance integrity has already failed.
  • We do not support this in the UI is never the same thing as the protocol cannot be reached this way.
  • Wrapper incidents are downstream lending incidents the moment the wrapper still has borrow-side authority anywhere.
  • Stablecoin systems turn wrapper-recognition mistakes into exported reserve loss faster than protocols that only mark paper bad debt internally.
  • A protocol needs a first-class way to say this asset may still exist, but it no longer deserves the price meaning it inherited yesterday.
  • Migration to a replacement wrapper is not just an asset-ops task; it is a solvency-control exercise that must revoke the old wrapper before the new one is trusted.

Why this incident matters

  • It is a clean wrapper-contagion cousin to Venus LUNA. In both cases the downstream protocol kept honoring collateral after its executable value had already collapsed, but Helio adds the sharper upstream token integrity failed first version.
  • The note preserves a useful distinction from generic oracle manipulation: nobody had to push BNB’s market price. The profitable move was to feed a broken wrapper into a collateral path that still trusted the wrapper’s old BNB meaning.
  • It also shows how stablecoin systems can export collateral mistakes faster than lenders with passive reserves. Once Helio minted HAY against bad collateral, external pool liquidity turned that accounting mistake into immediate peg damage and system-wide bad debt.

Internal linkages

Control surface

  • The decisive leverage sat in Helio’s collateral-admission semantics for aBNBc, the oracle mapping that still treated that wrapper through BNB price truth, the lack of an emergency de-recognition path for an upstream-compromised wrapper, direct-contract reachability of the mint path even if the UI tried to narrow it, and the external liquidity that let freshly minted HAY leave the system immediately.
  • Helio did not merely suffer from a stale price. It kept lending against the old identity of a wrapper whose issuance integrity had already failed.
  • The sharper operating question is not only was the BNB feed fresh? but what exact signal would have made Helio stop treating aBNBc as BNB-equivalent collateral before the next borrow could clear?

Sources

Last reviewed

  • 2026-08-04 UTC

Graph View

Backlinks