After $3.5 million was lost in an attack on Starknet lending agreements, Pragma flagged six prices of blockchain oracle as significant risks

In a liquidity assessment released by blockchain oracle service provider Pragma on 18 September, it flagged six of the 22 sources of market and interest rate data for mainnet as "critically weak" and warned lending platforms that having available quotes does not mean collateral can actually be sold to cover loans.

The attack on Nostra is the backdrop for this assessment

According to Nostra's account, on September 17, an attacker used the blockchain oracle price of NSTR as collateral in order to borrow other assets worth about $3.5 million using one account. This incident directly prompted Pragma to conduct a systematic examination of its data source liquidity status.

In the evaluation results, six data sources - BROTHER, DAI , DOG, EKUBO, LORDS and NSTR - were classified as critical while nine others were rated high risk. It should be noted that each of these unconfirmed data sources listed in this assessment was actually used for mortgage valuations.

blockchain oracle Why the offer is not equal to variable present value

Pragma explains the core logic in its report: blockchain oracle offers only a valuation, and liquidation requires an actual sale of collateral. If there is insufficient market depth, sales may not be completed at prices close to those quoted. That is, a loan might be backed by assets that look valuable but cannot be sold when repaid.

Taking the example of token s valued at US$10,000, as compared to a one-off offer on a $10 scale, there are four types of large bids for token : NSTR about 15%, EKUBO about 17%, BROTHER about 20%, and LORDS about 22% depreciation.

Regarding the DAI rating, it is noted that it mainly relates to data source concentration and tested Starknet - token swap paths. As current deployments have a different exit curve than older versions of the deployment, Pragma emphasizes that this critical rating cannot be interpreted as indicating insufficient mobility across the globe.

The report also warns that even using multiple data source labels does not necessarily solve the problem as different publishers and aggregators may rely on the same underlying market, which could reflect overlapping liquidity.

Follow-up: Suspension of operations and recall of funds still ongoing

In its September 17 event note, Pragma noted that the affected blockchain oracle response came from two data sources and would be rejected if a mandatory requirement of at least three source codes had been executed. Its integration guidelines also recommend enabling freshness checks and setting appropriate thresholds for asset risk. However, rejecting abnormal responses and ensuring collateral has sufficient liquidity are two mutually independent lines of defense.

Pragma attributed the anomalous input to a manipulated on-chain liquidity pool and stated that its regression analysis did not find errors in the calculation of small or medium digits.

For depositors, the most immediate impact was limited functionality. Nostra said on September 17 that it had suspended its lending, withdrawal and settlement functions to verify the scope of impacts and track cash flows; final losses and potential recoveries were uncertain at the time. Subsequent withdrawals resumed alongside recovery of funds are not confirmed in the announcement.

Revelations for the lending platform

The question that the report leaves to lenders is much more than whether or not a data source exists: which assets qualify as collateral, allow for many large openings and exit liquidity performance support.

Risk tip: This article is for public information only and does not constitute any investment advice. digital asset Prices fluctuate wildly, please do your own research and make a prudent decision