Oracle provider Pragma classified 6 of 22 mainnet market and rate feeds as critical risk in a September 18 assessment, warning that an available token price does not guarantee collateral can be sold to cover a loan.
The liquidity report followed a September 17 borrowing exploit at Nostra, a lending protocol on Starknet. According to Nostra's account, a manipulated NSTR oracle price allowed one account to borrow approximately $3.5 million of other assets against NSTR collateral.
Pragma placed BROTHER, DAI, DOG, EKUBO, LORDS, and NSTR in its critical category, with nine other feeds rated high risk.
Liquidity vs. Price Valuation
An oracle supplies a price valuation, but liquidation requires actually selling collateral in the market. A thin market may not absorb a large sale at the quoted price, creating a gap between theoretical value and realizable value.
Pragma's September 18 snapshot showed that at token quantities valued at $10,000, sell-quote deterioration ranged from 15% to 22% compared to quotes for $10 sales. Specifically, deterioration was approximately 15% for NSTR, 17% for EKUBO, 22% for LORDS, and 20% for BROTHER.
The DAI finding concerns source concentration and tested Starknet token routes, with current and legacy deployments having different exit curves.
Multiple Sources and Shared Dependencies
Pragma warned that publishers and aggregators can share underlying market dependencies, meaning multiple price sources may reflect overlapping liquidity rather than independent valuations.
In its September 17 incident account, Pragma noted that the affected oracle response had two contributing sources. The provider stated that an enforced three-source minimum would have rejected the response, and recommended that integrators implement freshness checks and thresholds suited to each asset's risk profile.
Pragma attributed the deviating input to a manipulated on-chain pool and said its reconstruction found no decimals or median-calculation errors.
Protocol Response and Status
Nostra paused lending, borrowing, withdrawals, and liquidations on September 17 while reconciling the impact and tracing funds. The protocol stated that final losses and potential recoveries remained unknown at the time of announcement.
Pragma separately reported that the attacker's address had been frozen and recovery work was ongoing. The subsequent status of withdrawals and recovery has not been confirmed.
