Pragma flags 6 price feeds as critical risk following $3.5M Starknet lending exploit
Oracle supplier Pragma categorized 6 of twenty-two mainnet market and fee feeds as critical risk in a Sept. 18 evaluation, warning lenders that an out there token price doesn’t set up that collateral might be offered to cowl a mortgage.
The liquidity report adopted a Sept. 17 borrowing exploit at Nostra, a lending protocol on Starknet. Nostra’s account reported {that a} manipulated NSTR oracle price allowed one account to borrow roughly $3.5 million of different belongings in opposition to NSTR collateral.
Pragma positioned BROTHER, DAI, DOG, EKUBO, LORDS and NSTR in its critical class, with 9 different feeds rated high risk. The evaluation doesn’t set up that each listed feed is used as collateral.
Why an oracle price just isn’t sufficient
An oracle provides a valuation. Liquidation requires promoting collateral, and a skinny market might not soak up that sale close to the quoted price. A mortgage might be backed by an obvious worth that can’t be realized when compensation is dependent upon promoting the token.
At token portions valued by the oracle at $10,000, sell-quote deterioration was about 15% for NSTR, 17% for EKUBO, 22% for LORDS, and 20% for BROTHER, measured in opposition to quotes for $10 gross sales.
The DAI discovering considerations supply focus and examined Starknet token routes. Current and legacy deployments had totally different exit curves, so the critical score can’t be learn as a discovering that DAI is globally illiquid.
Multiple supply labels additionally do not essentially remedy the issue. Pragma warns that publishers and aggregators can share underlying market dependencies, so a number of labels might replicate overlapping liquidity.
In its Sept. 17 incident account, Pragma stated the affected oracle response had two contributing sources. The supplier stated an enforced three-source minimal would have rejected it, and its integration steering additionally recommends freshness checks and thresholds suited to the asset’s risk.
Rejecting that response can be a separate safeguard from guaranteeing collateral has sufficient sale liquidity.
Pragma attributed the deviating enter to a manipulated on-chain pool and stated its reconstruction discovered no decimals or median-calculation error.
For depositors, the speedy consequence was restricted entry. In its Sept. 17 assertion, Nostra stated it paused lending, borrowing, withdrawals, and liquidations whereas it reconciled the impression and traced funds. It stated ultimate losses and potential recoveries had been nonetheless unknown.
The Sept. 17 announcement leaves the next standing of withdrawals and restoration unconfirmed.
In its replace that day, Pragma individually reported that the attacker’s handle had been frozen and restoration work was ongoing.
The report leaves lenders with a choice past whether or not a feed exists: which belongings qualify as collateral, how a lot publicity to permit, and whether or not their exit liquidity can assist liquidation. Publishing a price would not settle any of these questions by itself.
The publish Pragma flags 6 price feeds as critical risk following $3.5M Starknet lending exploit appeared first on CryptoSlate.
