Pragma raises alarms on 6 price feeds after Starknet lending exploit exposes risks in oracle valuations.
On September 18, the oracle provider Pragma released an assessment indicating that six out of 22 mainnet market and rate feeds have been flagged as critical risks. This alarming revelation comes on the heels of a significant exploit within the Starknet lending protocol, Nostra, which resulted in a loss of approximately $3.5 million. The report highlights a dangerous gap between oracle valuations and the liquidity required for lenders to effectively sell collateral.
The crux of the problem lies in the fact that while oracle prices can provide a valuation for tokens, this does not necessarily correlate with the ability of lenders to liquidate collateral swiftly and effectively. Pragma's findings specifically included the tokens BROTHER, DAI, DOG, EKUBO, LORDS, and NSTR as critical due to their vulnerability in the wake of the exploit.
The exploit on September 17 exploited a manipulated NSTR oracle price, allowing a single account to draw an estimated $3.5 million against NSTR collateral. This situation has raised urgent questions about the reliability of certain price feeds, especially when market conditions are unstable.
One of the key takeaways from Pragma’s assessment is that an apparently valuable token can have a vastly different exit liquidity profile. For instance, while an oracle might assign a $10,000 value to a token, the actual sale price could deteriorate significantly due to a thin market. The report indicated that the sell-quote deterioration was notable: NSTR experienced a 15% drop, while EKUBO, LORDS, and BROTHER showed deteriorations of 17%, 22%, and 20%, respectively.
This disparity means that a lender's ability to recover collateral might be severely compromised, leading to potential losses that extend beyond the mere reported figures. In many cases, the realization of quoted prices can be extremely challenging when liquidity is low.
The findings related to the DAI token point towards concerns over source concentration in oracle systems. While one might assume that multiple source labels can mitigate risks, Pragma has cautioned that many publishers and aggregators could share underlying market dependencies, thereby inadvertently reflecting overlapping liquidity issues.
During the September 17 incident, Pragma identified that the oracle response had relied on two contributing sources. Integral to the credibility of oracle systems is maintaining a minimum of three independent sources to prevent manipulated inputs from affecting valuations. The lack of enforced standards in this instance ultimately led to a compromised position.
Following the exploit on Nostra, the protocol announced the halting of all lending, borrowing, withdrawals, and liquidations while they assessed the situation and traced the funds. As of September 17, the final losses remained uncertain, and the status of withdrawals has yet to be confirmed. Pragma has since reported that the attacker's address is currently frozen, and recovery efforts are ongoing.
The events surrounding this exploit have forced lenders to reassess their risk management strategies. The decision-making process now encompasses not only whether a feed exists but also a comprehensive evaluation of which assets qualify as collateral, the level of exposure a lender is willing to accept, and the liquidity available for exiting positions. Publishing a price alone, as Pragma notes, does not adequately address these critical concerns.
The stark realities highlighted by the Nostra incident present an urgent call for improvement in oracle systems and lending protocols. As more lending platforms emerge in the crypto ecosystem, the necessity for robust risk assessments and transparent oracle mechanisms becomes increasingly vital.
In the face of rapid developments and vulnerabilities, maintaining public trust will depend on ensuring that collateral mechanisms function effectively and securely. Stakeholders at all levels—from developers to lenders—must collaborate to create a more resilient framework that can withstand manipulative tactics.
As the crypto ecosystem continues to evolve, it’s crucial for investors and users to stay informed about the evolving landscape, the technologies involved, and the risks present in decentralized finance and lending platforms. Vigilance, education, and innovation will be key in safeguarding against future vulnerabilities.
With the overall health of decentralized finance at stake, proactive measures must be prioritized to ensure that risk assessments are continuously updated and that oracle dependencies are managed effectively.
As we navigate through an increasingly complex digital economy, the lessons learned from the Starknet exploit will be integral in shaping future oracle systems, creating safer avenues for lending and borrowing within the blockchain space.