CryptoSlate
Pragma classified 6 of 22 mainnet market and rate feeds as critical risk after a manipulated NSTR oracle price let one account borrow approximately $3.5 million of other assets from Starknet lending protocol Nostra. The Sept. 18 assessment warned that an available token price does not prove collateral can be sold at that value. Nine additional feeds were rated high risk.
Why it matters
The critical list includes BROTHER, DAI, DOG, EKUBO, LORDS and NSTR, although the assessment does not establish that every feed is used as collateral. Pragma's comparison of indicative sell quotes found deterioration of 15% for NSTR, 17% for EKUBO, 22% for LORDS and 20% for BROTHER when comparing $10,000 sales with $10 sales.
That gap matters because lending protocols depend on liquidation, not just valuation. An oracle may report $10,000 of collateral, but a thin market may not absorb the sale near that price. Multiple publisher or aggregator labels also may share the same underlying liquidity, so source diversity alone does not remove the risk. Pragma noted that the DAI finding concerned source concentration and tested Starknet routes, not global DAI illiquidity.
Market impact
Nostra said it paused lending, borrowing, withdrawals and liquidations while it assessed the incident and traced funds. Final losses and potential recoveries remained unknown in the Sept. 17 account, while Pragma said the attacker's address had been frozen and recovery work was ongoing.
Pragma attributed the deviating oracle input to a manipulated on-chain pool and found no decimals or median-calculation error. It said a mandatory three-source minimum would have rejected the response, while freshness checks and asset-specific thresholds would provide separate safeguards. For lenders, the key question is not only whether a feed exists, but whether collateral has enough exit liquidity to support liquidation.
Frequently asked questions
-
What triggered Pragma's critical-risk assessment?
The assessment followed a Nostra exploit in which a manipulated NSTR oracle price allowed one account to borrow approximately $3.5 million of other assets against NSTR collateral.
-
Which feeds did Pragma classify as critical risk?
Pragma listed BROTHER, DAI, DOG, EKUBO, LORDS and NSTR as critical. It rated nine other feeds as high risk.
-
Why can an oracle price fail to protect a lending protocol?
An oracle provides a valuation, but liquidation requires selling the collateral. Thin markets may not absorb a large sale near the quoted price.
-
How much did larger sell quotes deteriorate for the tested tokens?
Indicative $10,000 sell quotes deteriorated by 15% for NSTR, 17% for EKUBO, 22% for LORDS and 20% for BROTHER compared with $10 quotes.
-
What actions did Nostra take after the exploit?
Nostra paused lending, borrowing, withdrawals and liquidations while it reconciled the impact and traced funds. Final losses and potential recoveries remained unknown.
CoinDesk
TheBlock
Lookonchain