Following a $3.5 million borrowing exploit on the Starknet lending protocol Nostra on September 17, 2026, oracle provider Pragma flags six token price feeds as critical risks. Pragma's September 18 assessment warns that oracle valuations do not guarantee sufficient market liquidity for liquidating collateral. Nostra pauses operations to trace funds, while Pragma reports that the attacker's address is frozen, though final losses and recoveries remain unconfirmed.
Nostra lending exploit
- ▪A borrowing exploit on the Starknet lending protocol Nostra on September 17, 2026, resulted in approximately $3.5 million in assets being borrowed against manipulated NSTR collateral.
- ▪Oracle provider Pragma attributed Nostra's September 17, 2026, $3.5 million borrowing exploit to a manipulated on-chain pool, finding no decimals or median-calculation errors in its reconstruction
Pragma oracle liquidity assessment
- ▪Oracle provider Pragma released a liquidity report on September 18, 2026, classifying 6 of 22 mainnet market and rate feeds as critical risk.
- ▪Pragma's September 18, 2026, assessment warned lenders that an available oracle token price does not guarantee that collateral can be successfully sold to cover a loan.
Oracle price slippage risk
- ▪Pragma's September 18, 2026, snapshot showed that sell-quote prices for $10,000 volumes deteriorated by 15% to 22% compared to $10 sales across four analyzed tokens: NSTR, EKUBO, LORDS, and BROTHER
- ▪Pragma warned that multiple publisher and aggregator labels may share underlying market dependencies, meaning several labels can reflect overlapping liquidity.
Critical-risk token feeds
- ▪Pragma clarified that the critical rating it assigned to DAI on Starknet in its September 18, 2026, assessment relates to source concentration and tested routes, rather than global illiquidity
- ▪Pragma designated six token feeds for BROTHER, DAI, DOG, EKUBO, LORDS, and NSTR as critical risk in its September 18, 2026, liquidity assessment
Incident response procedures
- ▪Nostra paused lending, borrowing, withdrawals, and liquidations on September 17, 2026, to reconcile the impact of its $3.5 million borrowing exploit and trace funds
- ▪Pragma stated that enforcing a three-source minimum would have rejected the manipulated NSTR oracle response that contributed to Nostra's September 17, 2026, $3.5 million borrowing exploit
Fund recovery status
- ▪Pragma reported on September 17, 2026, that the attacker's address behind Nostra's $3.5 million borrowing exploit had been frozen and recovery work was ongoing
- ▪Nostra stated on September 17, 2026, that final losses and potential recoveries from its $3.5 million borrowing exploit remained unknown
Debatable claims
- ▪DeFi oracles should incorporate asset liquidity into their price feeds
- ▪Nostra should ban low-liquidity tokens from being used as collateral
- ▪Nostra was justified in pausing withdrawals during the exploit
Story comments
Loading comments…