Pragma flags six Starknet price feeds as critical after $3.5M exploit

Pragma classified BROTHER, DAI, DOG, EKUBO, LORDS and NSTR as critical risk among 22 mainnet market and rate feeds in its Sept. 18 assessment. It rated nine other feeds as high risk. The assessment does not establish that every listed feed is used as collateral. The assessment followed a Sept. 17 borrowing exploit at Nostra, a lending protocol on Starknet. Nostra reported that a manipulated NSTR oracle price allowed one account to borrow approximately $3.5 million in other assets against NSTR collateral. Pragma warned that an available token price does not establish that collateral can be sold to cover a loan. An oracle provides a valuation, but liquidation requires selling the collateral, and a thin market may not absorb that sale near the quoted price. At token quantities valued by the oracle at $10,000, sell-quote deterioration measured against quotes for $10 sales was about 15% for NSTR, 17% for EKUBO, 22% for LORDS and 20% for BROTHER. Pragma said the DAI finding concerned source concentration and tested Starknet token routes. It said current and legacy deployments had different exit curves, so the critical rating cannot be read as a finding that DAI is globally illiquid. Pragma also warned that multiple publisher and aggregator labels may not provide independent protection because they can share underlying market dependencies. In its Sept. 17 incident account, Pragma said the affected oracle response had two contributing sources. It said an enforced three-source minimum would have rejected the response, and its integration guidance recommends freshness checks and thresholds suited to the asset's risk. Pragma said rejecting that response would be a separate safeguard from ensuring that collateral has adequate sale liquidity. It attributed the deviating input to a manipulated on-chain pool and said its reconstruction found no decimals or median-calculation error. Nostra said it paused lending, borrowing, withdrawals and liquidations while it reconciled the impact and traced funds. It said final losses and potential recoveries were still unknown. The Sept. 17 announcement did not confirm the subsequent status of withdrawals or recovery. Pragma separately reported that the attacker's address had been frozen and that recovery work was ongoing. The report said lenders must consider which assets qualify as collateral, how much exposure to allow and whether exit liquidity can support liquidation, because publishing a price does not settle those questions by itself.