Nostra Finance Oracle Price Manipulation Attack Exposes Starknet DeFi Vulnerability

Nostra Finance's money market on Starknet was hit by an oracle price manipulation attack on September 17, according to GoPlus Security. The attacker borrowed roughly $3.5 million in assets against inflated collateral. The NSTR token's oracle price was pumped from about $0.006 to $49.5, a staggering increase of approximately 8,000x.

The mechanism behind the attack hinged on gaming a data aggregator rather than breaking Nostra's smart contracts directly. By seeding a fake NSTR/SolvBTC pool with minimal one-sided liquidity, the attacker manipulated which pool GeckoTerminal selected as the reference source for NSTR's price.

Nostra Finance has fully paused its money market, disabling supply, borrow, and liquidation functions. The immediate fallout from the exploit was a $3.5 million drain in borrowed assets.