Key Highlights
- Oracle provider Pragma classified six of 22 Starknet mainnet market and rate feeds as critical risk in a Sept. 18 assessment, including NSTR, EKUBO, LORDS, BROTHER, DOG, and $DAI.
- A manipulated NSTR oracle price enabled a ~$3.5 million borrowing exploit at the Nostra lending protocol on Sept. 17, prompting Nostra to pause all lending, borrowing, withdrawals, and liquidations.
- Pragma’s analysis demonstrates that oracle prices do not guarantee liquidation liquidity, with sell-quote deterioration ranging from 15% to 22% for critical tokens when measured against $10,000 versus $10 quotes.
Pragma Issues Critical Risk Assessment for Starknet Oracle Feeds
Blockchain oracle provider Pragma published a liquidity risk assessment on Sept. 18 classifying six of 22 Starknet mainnet market and rate feeds as critical risk, warning lenders that the mere availability of a token price does not establish that collateral can be sold to cover a loan. The assessment placed BROTHER, $DAI, DOG, EKUBO, LORDS, and NSTR in its critical category, with nine additional feeds rated high risk. Pragma emphasized that the evaluation does not confirm every listed feed is actively used as collateral in lending markets.
Nostra Exploit Highlights Oracle Manipulation Vulnerability
The report followed a Sept. 17 borrowing exploit at Nostra, a lending protocol on Starknet. According to Nostra’s account, a manipulated NSTR oracle price allowed one account to borrow approximately $3.5 million of other assets against NSTR collateral. In its Sept. 17 statement, Nostra said it “paused lending, borrowing, withdrawals, and liquidations while it reconciled the impact and traced funds,” adding that “final losses and potential recoveries were still unknown.” The announcement leaves the subsequent status of withdrawals and recovery unconfirmed.
Pragma’s incident analysis identified two contributing sources for the affected oracle response. The provider stated that an enforced three-source minimum would have rejected the manipulated input, and its integration guidance recommends freshness checks and thresholds suited to the asset’s risk profile. Pragma attributed the deviating input to a manipulated on-chain pool and said its reconstruction found no decimals or median-calculation error. The provider separately reported that the attacker’s address had been frozen and recovery work was ongoing.
Why Oracle Valuations Don’t Equal Liquidation Liquidity
The core finding underscores a structural gap in decentralized lending: an oracle supplies a valuation, but liquidation requires selling collateral, and a thin market may not absorb that sale near the quoted price. As Pragma explained, “An oracle supplies a valuation. Liquidation requires selling collateral, and a thin market may not absorb that sale near the quoted price. A loan can be backed by an apparent value that cannot be realized when repayment depends on selling the token.”
At token quantities valued by the oracle at $10,000, sell-quote deterioration was measured at approximately 15% for NSTR, 17% for EKUBO, 22% for LORDS, and 20% for BROTHER, when compared against quotes for $10 sales. Pragma’s Sept. 18 snapshot showed indicative $10,000 sell quotes deteriorating 15% to 22% versus $10 quotes across these four tokens.
Source Concentration and Aggregation Risks
The $DAI critical rating stems from source concentration and tested Starknet token routes rather than global illiquidity. Pragma noted that current and legacy deployments had different exit curves, so the critical rating cannot be read as a finding that $DAI is globally illiquid. The provider also warned that multiple source labels do not necessarily solve the problem: “publishers and aggregators can share underlying market dependencies, so several labels may reflect overlapping liquidity.”
Protocol Response and Recovery Efforts
For depositors, the immediate consequence was restricted access to funds. Nostra’s pause of all protocol functions remains in effect while the team reconciles impact and traces funds. Pragma’s report confirmed the attacker’s address was frozen and that recovery work continues, though final loss figures and potential recoveries remain undetermined as of the Sept. 17 disclosures.
Why This Matters
Pragma’s assessment exposes a fundamental risk in decentralized finance: the conflation of price availability with exit liquidity. Lending protocols that accept oracle-valued tokens as collateral without independent liquidity analysis may face unbacked loans when markets cannot absorb forced sales at quoted prices. The Nostra exploit demonstrates how a single manipulated feed can cascade into multi-million dollar losses. For the broader Starknet ecosystem, the report forces a reevaluation of which assets qualify as collateral, appropriate exposure limits, and whether exit liquidity can support liquidation under stress. As Pragma concluded, “Publishing a price doesn’t settle any of those questions by itself.”
Frequently Asked Questions
- Which tokens did Pragma classify as critical risk in its Sept. 18 assessment?
- Pragma placed BROTHER, $DAI, DOG, EKUBO, LORDS, and NSTR in its critical risk category, with nine other feeds rated high risk.
- What caused the Nostra exploit on Sept. 17?
- A manipulated NSTR oracle price allowed one account to borrow approximately $3.5 million of other assets against NSTR collateral.
- Does an oracle price guarantee that collateral can be liquidated at that value?
- No. Pragma’s analysis shows that oracle valuations do not reflect actual sell-side liquidity. Sell-quote deterioration for critical tokens ranged from 15% to 22% at $10,000 volumes versus $10 quotes, meaning forced liquidations would likely realize significantly less than the oracle price.
