Oracles tell you what a token is “worth.” Liquidations ask a colder question: can you actually sell that collateral without eating glass? CryptoSlate reports that oracle provider Pragma just answered with a red flag—rating 6 of 22 mainnet market and rate feeds as critical risk in a September 18 assessment that landed in public view around September 22, 2026.
The timing is not subtle. On September 17, Starknet lender Nostra said a manipulated NSTR oracle price let one account borrow roughly $3.5 million of other assets against NSTR collateral. Pragma’s follow-up liquidity report is the industry’s uncomfortable hangover: a live price feed is not the same thing as exit liquidity, and DeFi risk desks that blur those concepts are writing future incident reports in advance.
Which feeds got the critical stamp
Pragma parked BROTHER, DAI, DOG, EKUBO, LORDS, and NSTR in the critical bucket, with nine more feeds rated high risk. The report does not claim every named feed is used as collateral everywhere—only that lenders should treat quoted value and sellable value as different animals.
The math that hurts: at sizes valued by the oracle around $10,000, sell-quote deterioration versus tiny $10 quotes ran about 15% for NSTR, 17% for EKUBO, 22% for LORDS, and 20% for BROTHER. In plain English, the bigger ticket you need to dump in a liquidation, the worse the market pays you relative to the cute retail quote that made the loan look overcollateralized on a dashboard.
DAI’s critical tag is a nuance trap. CryptoSlate notes it reflects source concentration and tested Starknet token routes—not a claim that DAI is globally illiquid. Different current vs legacy deployments showed different exit curves. Multiple source labels also do not automatically fix things if publishers and aggregators share underlying market dependencies; “three sources” can still be three windows into the same thin pool.
What went wrong in the Nostra incident
Pragma’s own incident notes said the bad oracle response had two contributing sources; an enforced three-source minimum would have rejected it. Integration guidance also pushes freshness checks and risk-tuned thresholds. Separately, Pragma attributed the deviant input to a manipulated on-chain pool and said reconstruction found no decimals or median-calculation bug—so this was not a “oops, wrong decimal” facepalm so much as a market-structure failure wearing an oracle costume.
Rejecting a thin response and ensuring collateral can be sold are different safeguards. Nostra paused lending, borrowing, withdrawals, and liquidations while tracing funds; final losses and recoveries were still unknown in the early statements. Pragma said the attacker’s address had been frozen and recovery work was ongoing—status that readers should treat as fluid until protocols publish a closed postmortem with numbers that survive scrutiny.
The lender checklist that actually matters
Publishing a price settles almost nothing for risk desks. The decisions that matter look boring on purpose:
- Which assets qualify as collateral at all
- How much exposure is allowed per asset and per account
- Whether exit liquidity can absorb forced sales near the oracle mark
- Whether aggregator “diversity” is real or just mirrored labels on the same thin pool
- What happens to depositors when pauses turn “liquidity” into a waiting room
That is the grown-up DeFi lesson of late September: oracle correctness is necessary and insufficient. Thin markets turn “fully collateralized” into fiction the moment someone has to sell into a book that cannot eat the size.
Geeknewz take
Bull-market price candles get the headlines; oracle liquidity footnotes keep protocols alive. Pragma’s critical list after Nostra’s $3.5M scare is a reminder that Starknet (and every other L2 money market) lives or dies on whether collateral can clear, not just whether a feed updates on schedule. If your favorite lending UI still treats oracle mid as gospel, maybe wait for the next risk-parameter patch—and a liquidity report that survives a $10k sell test—before maxing the borrow slider.
Source: CryptoSlate (Liam ‘Akiba’ Wright)