$3.5M Gone: Pragma Just Flagged 6 Starknet Price Feeds as Critical Risk
Six price feeds powering Starknet's lending markets are now classified as critical risk, and the oracle that runs them is saying the quiet part loud.
Pragma's September 18 assessment, published in the wake of a $3.5M lending exploit, confirms what DeFi skeptics have warned about for years: oracle prices and real-world liquidity are not the same thing. The gap between what an oracle says collateral is worth and what a lender can actually sell it for is exactly the hole attackers crawl through.
What Actually Happened
The exploit targeted Starknet-based lending protocols and walked away with $3.5M. The mechanism was familiar to anyone who has watched DeFi get drained over the last three years. Collateral was valued at oracle prices. Actual market depth told a very different story. The delta between those two numbers became the attacker's profit.
Pragma's post-incident review did not bury the finding. Six feeds were flagged as carrying critical risk, meaning the liquidity needed to liquidate collateral at the prices those feeds report does not reliably exist on-chain. That is not a minor calibration issue. That is a structural vulnerability sitting underneath every loan those feeds touch.
Why This Matters Beyond Starknet
This is not a Starknet-specific problem. It is a DeFi-wide one.
Oracle manipulation and liquidity mismatch have been the dominant exploit vector in decentralized lending for three years running. Every protocol that lets users post collateral priced by a feed, without stress-testing whether that collateral can actually be liquidated at that price, is carrying hidden tail risk.
Starknet's lending ecosystem is smaller than Ethereum mainnet or Arbitrum, which is partly why the damage was contained at $3.5M. Run the same structural flaw through a larger protocol with deeper positions and the number scales accordingly.
Pragma flagging the feeds publicly is the right move. It forces the ecosystem to either fix the feeds, remove the affected collateral types, or reduce loan-to-value ratios until liquidity catches up with oracle pricing. Any protocol that does none of the three after this disclosure is choosing to stay exposed.
What to Watch
If you are lending or borrowing on any Starknet protocol right now, check which price feeds your collateral is settled against. If any of Pragma's six flagged feeds are in the stack, your liquidation risk is not priced correctly.
More broadly, watch whether other oracle providers on Ethereum and Solana run similar liquidity audits off the back of this. If they do and the findings are quiet, that is reassuring. If they go silent, that is the tell.
The $3.5M is already gone. The six feeds are still live.