Pragma said in a Sept. 18 assessment that six of its 22 Starknet mainnet market and rate feeds carried critical risk, a day after a manipulated NSTR oracle price let an account borrow about $3.5 million from Starknet lending protocol Nostra.

According to Pragma, the feeds it flagged as critical risk were BROTHER, DAI, DOG, EKUBO, LORDS and NSTR. Nine other feeds were rated high risk. The review followed Nostra’s Sept. 17 exploit, in which a manipulated NSTR oracle price allowed one account to borrow roughly $3.5 million against NSTR collateral.

Pragma said an oracle price alone does not guarantee that collateral can be sold to cover a loan. In practice, liquidation depends on whether the collateral can be offloaded into the market without severe slippage. In its assessment, Pragma said sell-quote deterioration for token quantities valued at $10,000 was about 15% for NSTR, 17% for EKUBO, 22% for LORDS and 20% for BROTHER.

The DAI feed raised a different concern. Pragma said source concentration and tested Starknet token routes could still create liquidity issues even when multiple source labels appear to exist. The point suggests that nominal source diversity may not solve execution risk if underlying trading paths remain narrow.

After the exploit, Nostra paused lending, borrowing, withdrawals and liquidations while it assessed the impact. The attacker’s address has been frozen, but the status of withdrawals and recovery remains unclear. No broader remediation timeline was disclosed in the available information.

Separately, external research has highlighted infrastructure risk around Pragma’s Starknet oracle contracts, including concerns that outages or feed disruption could affect protocols that use its data for collateral pricing and liquidations. That adds to scrutiny on oracle resilience across Starknet after multiple recent incidents tied to price feeds and liquidation logic.

Why It Matters

This episode goes beyond a single exploit because it exposes a weak point in DeFi lending design: a quoted oracle price may look valid while the underlying collateral cannot be liquidated at anything close to that level. For smaller on-chain markets, that gap can turn a pricing input into a solvency problem for lenders and money markets.

It also puts Starknet’s DeFi stack under pressure to prove that oracle infrastructure, collateral onboarding and emergency controls can work together under stress. If protocols continue relying on thin-liquidity assets with limited liquidation depth, similar incidents could remain a structural risk rather than a one-off failure.