$3M Liquidated by Starknet Oracle Glitch
A two-minute glitch in a price feed on Starknet's Vesu protocol triggered millions of dollars in unwanted liquidations. On September 4, between 04:08 and 04:10 UTC, an upstream price provider called Pragma supplied faulty data to several Vesu liquidity pools. This caused 47 borrowing positions holding $3 million in collateral to be irregularly liquidated.
Vesu's smart contracts had no vulnerability; the protocol confirmed that they operated as designed and contained no exploit. The problem was with the external price feed, which reported incorrect prices for a brief period before correcting itself within two minutes.
The incident highlights the risk of oracle dependence in decentralized finance (DeFi). Blockchain smart contracts rely on external oracle systems to source, aggregate, and deliver market data on-chain. A failure at any single stage of this pipeline can pass faulty numbers into an otherwise functioning contract, leading to unintended consequences like liquidations.
Vesu is working with Pragma, StarkWare, the Starknet Foundation, and pool curators to recover the funds collected through the abnormal liquidations. However, no reimbursement amount or timeline has been confirmed.