Oracle provider Pragma has classified six of its 22 mainnet market and rate feeds on Starknet as critical risk, in a liquidity assessment published September 18 — one day after a manipulated NSTR price let a single account borrow roughly $3.5 million from the Nostra lending protocol.
The core warning of the report, per CryptoSlate, is a distinction lenders keep relearning: an oracle supplies a valuation, but repayment depends on selling the collateral — and a thin market may not absorb that sale anywhere near the quoted price. CryptoRank and KuCoin's news desk corroborated the findings.
Pragma placed BROTHER, DAI, DOG, EKUBO, LORDS and NSTR in its critical category, with nine other feeds rated high risk. The assessment does not establish that every listed feed is used as lending collateral.
Measuring the gap between price and exit
The assessment quantified exit risk directly. At token quantities the oracle valued at $10,000, indicative sell quotes deteriorated roughly 15% for NSTR, 17% for EKUBO, 20% for BROTHER and 22% for LORDS, measured against quotes for $10 sales — meaning a lender liquidating a mid-sized position in those tokens would realize materially less than the oracle valuation suggested.
Two caveats in the report deserve note. The DAI critical rating stems from source concentration and the specific Starknet token routes tested — not a finding that DAI is globally illiquid; current and legacy deployments showed different exit curves. And multiple source labels are no guarantee of redundancy: Pragma warns that publishers and aggregators can share underlying market dependencies, so several nominally independent feeds may reflect overlapping liquidity.
The Nostra incident, reconstructed
In a separate incident account, Pragma said the deviating NSTR oracle input traced to a manipulated on-chain pool, and that its reconstruction found no decimals or median-calculation error. The affected response had only two contributing sources; Pragma said an enforced three-source minimum would have rejected it, and its integration guidance recommends freshness checks and deviation thresholds suited to each asset's risk.
That safeguard is separate from the liquidity question. Rejecting a bad price prevents an inflated valuation; it does not ensure the collateral behind a loan can actually be sold. Nostra's exploit — in which the attacker seeded a fake liquidity pool to price NSTR thousands of times above market, then borrowed against the inflated collateral — sat precisely at the intersection of the two failures.
Nostra paused lending, borrowing, withdrawals and liquidations on September 17 while reconciling impact; final losses and potential recoveries remain unknown. Pragma separately reported the attacker's address has been frozen and recovery work is ongoing.
A bruising month for Starknet's oracle layer
The assessment closes a difficult stretch for the provider itself. On September 4, incorrect prices from Pragma's publishing pipeline were distributed across several Starknet feeds, triggering 47 liquidations on the Vesu money market, per BeInCrypto — an operational failure that preceded the manipulation attack its new report now dissects. Pragma's decision to publish per-feed liquidity grades after the Nostra incident is the kind of disclosure that makes oracle risk legible; the fact that it arrives the week after two Starknet oracle incidents in one month is also the reason it was needed.
TrustGrade tracks the security posture of oracle providers and lending protocols. Verified trust data: trustgrade.ai.