Pragma flags six Starknet feeds after $3.5M exploit

Pragma classified six Starknet price feeds as critical in a Sept. 18 snapshot after a Sept. 17 borrowing exploit allowed a single account to borrow about $3.5 million by manipulating the NSTR oracle input. Nostra, the lending protocol targeted in the incident, paused lending, borrowing, withdrawals and liquidations while it traced funds and reconciled the impact.

The feeds flagged as critical were BROTHER, DAI, DOG, EKUBO, LORDS and NSTR out of 22 mainnet market and rate feeds reviewed. Pragma also rated nine additional feeds as high risk. The assessment compared published oracle valuations with measures of how much of a token can be sold quickly at or near those prices.

Pragma’s reconstruction of the incident found a manipulated on-chain pool produced a deviating input to an oracle response for NSTR. The firm reported no decimal or median-calculation error in the oracle logic and attributed the abnormal reading to the manipulated pool rather than a software bug.

To measure market depth, Pragma used indicative sell quotes and compared quotes for small trades against quotes for token amounts valued by the oracle at $10,000. At the $10,000 level, sell-quote deterioration versus $10 sales was about 15% for NSTR, 17% for EKUBO, 22% for LORDS and 20% for BROTHER. Those figures indicate that the amount realizable quickly at the quoted price can be materially lower than the oracle valuation when market depth is limited.

Pragma flagged DAI as critical for different reasons related to source concentration and tested token routes. Current and legacy deployments showed different exit curves, and the firm noted the finding does not mean DAI is illiquid across all platforms. The assessment also warned that multiple source labels can still reflect overlapping market dependencies among aggregators and publishers.

The affected oracle response used two contributing sources, and Pragma noted that enforcing a minimum of three independent sources would have rejected the deviating reading. Its integration guidance recommends source minimums, freshness checks and thresholds tailored to each asset’s risk profile as separate safeguards from verifying that collateral can be sold at quoted prices.

Nostra restricted access for depositors while investigating. Pragma reported the attacker’s address had been frozen and recovery work was ongoing. As of the Sept. 18 snapshot, final losses, any recoveries and the status of withdrawals had not been confirmed.

Pragma’s evaluation outlines choices for lenders about which assets to accept as collateral, how much exposure to permit and whether a token’s exit liquidity can support prompt liquidation when a loan must be covered.