Pragma flags 6 price feeds as critical risk following $3.5M Starknet lending exploit

Oracle provider Pragma classified 6 of 22 mainnet market and rate feeds as critical risk in a Sept. 18 assessment, warning lenders that an available token price does not establish that collateral can be sold to cover a loan.

The liquidity report followed a Sept. 17 borrowing exploit at Nostra, a lending protocol on Starknet. Nostra’s account reported that a manipulated NSTR oracle price allowed one account to borrow approximately $3.5 million of other assets against NSTR collateral.

Pragma placed BROTHER, DAI, DOG, EKUBO, LORDS and NSTR in its critical category, with nine other feeds rated high risk. The assessment does not establish that every listed feed is used as collateral.

Why an oracle price is not enough

An oracle supplies a valuation. Liquidation requires selling collateral, and a thin market may not absorb that sale near the quoted price. A loan can be backed by an apparent value that cannot be realized when repayment depends on selling the token.

At token quantities valued by the oracle at $10,000, sell-quote deterioration was about 15% for NSTR, 17% for EKUBO, 22% for LORDS, and 20% for BROTHER, measured against quotes for $10 sales.

The DAI finding concerns source concentration and tested Starknet token routes. Current and legacy deployments had different exit curves, so the critical rating cannot be read as a finding that DAI is globally illiquid.

Multiple source labels also don't necessarily solve the problem. Pragma warns that publishers and aggregators can share underlying market dependencies, so several labels may reflect overlapping liquidity.

In its Sept. 17 incident account, Pragma said the affected oracle response had two contributing sources. The provider said an enforced three-source minimum would have rejected it, and its integration guidance also recommends freshness checks and thresholds suited to the asset’s risk.

Rejecting that response would be a separate safeguard from ensuring collateral has adequate sale liquidity.

Pragma attributed the deviating input to a manipulated on-chain pool and said its reconstruction found no decimals or median-calculation error.

For depositors, the immediate consequence was restricted access. In its Sept. 17 statement, Nostra said it paused lending, borrowing, withdrawals, and liquidations while it reconciled the impact and traced funds. It said final losses and potential recoveries were still unknown.

The Sept. 17 announcement leaves the subsequent status of withdrawals and recovery unconfirmed.

In its update that day, Pragma separately reported that the attacker’s address had been frozen and recovery work was ongoing.

The report leaves lenders with a decision beyond whether a feed exists: which assets qualify as collateral, how much exposure to allow, and whether their exit liquidity can support liquidation. Publishing a price doesn't settle any of those questions by itself.