Audit log

Every state-changing event for Nostra Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-20 12:03:59Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 448,726,144

   sig

   5oWKYpfjPCXF…DfucoN8Zcopyexplorer ↗

   hash

   6x5mCyL8Tbvm…SRAYejoKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (18329 B) ▸

   {"actor":"system:backfill","investigation_id":"581dea21-b92e-40cf-bc6f-6101b820e33e","kind":"publish","page_slug":"nostra-finance","published_at":"2026-09-20T12:03:58.891Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Nostra Finance","sections":[{"content":"On September 17, 2026, at approximately 05:23 UTC, an attacker executed an oracle price manipulation attack against Nostra's lending market on Starknet. According to technical analysis published by GoPlus Security and detailed in reporting by CryptoTimes and the DEV Community, the attacker created a fake NSTR/SolvBTC liquidity pool seeded with approximately 1.5 SolvBTC of one-sided liquidity. The attacker then conducted wash trades through this thin pool, pulling liquidity from the market-making range and executing repeated swaps that printed NSTR's reported price from approximately $0.006 to approximately $49.50 — a roughly 8,000x increase — within minutes. GoPlus Security alleged that this technique hijacked GeckoTerminal's pool-selection logic, causing the protocol's price feed to adopt the manipulated rate as the reference price. Using this artificially inflated NSTR as collateral, the attacker borrowed approximately $3.5 million in ETH, STRK, USDC, USDT, WBTC, and DAI from Nostra's money market between 05:48 and 05:50 UTC. The borrowed proceeds were subsequently routed through DEXes AVNU, Ekubo, and JediSwap on Starknet. A Starknet contract address identified by Voyager explorer as holding remaining funds was reported as 0x06d48ef7ab62c26e3ef1987c322096cd508e9034c82048783a6b438fc1344bc3. PeckShield and CertiK independently tracked approximately $1.92 million in assets bridged to Ethereum mainnet, including approximately 234.57 ETH and 1.3 million DAI, arriving at Ethereum address 0xa059aaab82773caf622de9d9a0f2dbf9aa7f3c37. Approximately 2.2 million STRK were also reported by analysis in the DEV Community writeup as having been bridged off Starknet via the NEAR Intents bridge. The borrowed sum exceeded NSTR's entire circulating market capitalization of approximately $546,751 to $590,000 by more than five times. Nostra paused all supply, borrow, withdrawal, and liquidation functions upon detection, and the team issued a public warning that it would not send direct messages or ask users to connect wallets as part of any recovery process. No full technical post-mortem had been published as of the date of this report, and final losses and any recoveries remained unconfirmed.","heading":"September 2026 Oracle Manipulation Exploit","severity":"critical","sources":[{"credibility":2,"name":"Nostra Halts Its Starknet Money Market After a $3.5M NSTR Oracle Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/09/18/nostra-halts-starknet-money-market-after-3-5m-nstr-oracle-exploit/"},{"credibility":2,"name":"Nostra Finance $3.5M Exploit: How an 8,000x Oracle Pump Drained a Starknet Money Market","type":"research","url":"https://dev.to/qanzhi111/nostra-finance-35m-exploit-how-an-8000x-oracle-pump-drained-a-starknet-money-market-2h2l"},{"credibility":2,"name":"Nostra Pauses Market After NSTR Oracle Manipulation","type":"news_article","url":"https://cryptodaily.co.uk/2026/09/nostra-nstr-oracle-manipulation-bridged-ethereum"},{"credibility":2,"name":"Nostra Halts Starknet Money Market After $3.5M Oracle Manipulation Exploit","type":"news_article","url":"https://blockfence.io/nostra-halts-starknet-money-market-after-3-5m-oracle-manipulation-exploit/"},{"credibility":2,"name":"Nostra hit by $3.5M Oracle attack as security concerns re-emerge — Details","type":"news_article","url":"https://ambcrypto.com/nostra-hit-by-3-5m-oracle-attack-as-security-concerns-re-emerge-details/"}]},{"content":"Security analysts including GoPlus Security, PeckShield, CertiK, and SlowMist, as reported across multiple outlets, independently classified the September 2026 event as an oracle price manipulation exploit rather than a smart contract reentrancy or unauthorized mint. Technical analysis published on the DEV Community identified several specific oracle design gaps that allegedly enabled the attack: the protocol relied on spot prices without time-weighted average price (TWAP) smoothing across multiple venues; no deviation circuit breakers existed to halt borrowing against collateral experiencing extreme price moves; no borrow caps were enforced relative to a token's market capitalization; and NSTR was not placed in an isolation mode appropriate for a low-liquidity governance token. The March 2025 xSTRK/sSTRK incident (see Prior Security Incidents section) had also exposed single-oracle dependency risk, and analysts noted that following that incident Nostra had stated it planned to implement redundant oracle systems, circuit breakers, and price anomaly monitoring. As of the date of this report, Nostra had not published a full technical post-mortem explaining exactly how the manipulated pool became the protocol's reference feed for September 2026, leaving some mechanistic details unconfirmed.","heading":"Oracle Design Weaknesses Identified","severity":"high","sources":[{"credibility":2,"name":"Nostra Finance $3.5M Exploit: How an 8,000x Oracle Pump Drained a Starknet Money Market","type":"research","url":"https://dev.to/qanzhi111/nostra-finance-35m-exploit-how-an-8000x-oracle-pump-drained-a-starknet-money-market-2h2l"},{"credibility":2,"name":"Nostra Finance Exploit Highlights Starknet DeFi Vulnerability","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/18/nostra-finance-exploit/"},{"credibility":2,"name":"DeFi Lending Market: How to Check Collateral Properly","type":"news_article","url":"https://cryptoticker.io/en/defi-lending-market-collateral-check/"}]},{"content":"On March 24, 2025, Nostra Finance disabled borrowing for xSTRK and sSTRK, two liquid staking derivatives of STRK, after detecting price feed errors that artificially inflated their reported values. According to reporting from Bitget News and Bitnewsbot, the oracle feeds for these assets inflated by approximately three times between Starknet blocks 1256310 and 1256360, with xSTRK reportedly moving from approximately $0.1793 to $0.5897 in that window. Nostra responded by reducing collateral caps for the affected assets to zero and pausing new borrowing against them. No confirmed financial losses were reported from this incident, and the protocol subsequently stated intentions to implement redundant oracle systems, circuit breakers, and enhanced monitoring. The recurrence of an oracle-related failure in September 2026 raised questions among analysts about the completeness of those remediation efforts.","heading":"Prior Security Incident: March 2025 xSTRK/sSTRK Oracle Error","severity":"medium","sources":[{"credibility":2,"name":"The DeFi lending protocol Nostra has temporarily suspended borrowing related to xSTRK and sSTRK due to price data errors","type":"news_article","url":"https://www.bitget.com/news/detail/12560604662412"},{"credibility":2,"name":"Starknet's Nostra Protocol Pauses LST Borrowing After Oracle Error","type":"news_article","url":"https://bitnewsbot.com/starknets-nostra-protocol-pauses-lst-borrowing-after-oracle-error/"},{"credibility":2,"name":"Nostra Halts Its Starknet Money Market After a $3.5M NSTR Oracle Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/09/18/nostra-halts-starknet-money-market-after-3-5m-nstr-oracle-exploit/"}]},{"content":"Following the September 17, 2026 exploit, Nostra halted all lending, borrowing, withdrawal, and liquidation functions across its Starknet money market. TVL reportedly collapsed from approximately $4 million to approximately $710,000 following the event, according to the DEV Community technical analysis. The protocol stated it was working with relevant parties to trace funds and explore recovery options, but provided no reopening timeline as of the date of reporting. Nostra issued a public warning that it would never privately ask users to connect wallets or sign transactions as part of any recovery process. Lenders in the affected pools faced an uncertain recovery on their deposited assets, as the $3.5 million in outstanding undercollateralized loans exceeded the protocol's remaining TVL. Final loss figures remained unconfirmed pending a post-mortem the team indicated would be forthcoming.","heading":"Protocol Status and User Impact","severity":"critical","sources":[{"credibility":2,"name":"Nostra Halts Its Starknet Money Market After a $3.5M NSTR Oracle Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/09/18/nostra-halts-starknet-money-market-after-3-5m-nstr-oracle-exploit/"},{"credibility":2,"name":"Nostra Finance $3.5M Exploit: How an 8,000x Oracle Pump Drained a Starknet Money Market","type":"research","url":"https://dev.to/qanzhi111/nostra-finance-35m-exploit-how-an-8000x-oracle-pump-drained-a-starknet-money-market-2h2l"},{"credibility":2,"name":"Nostra Halts Starknet Money Market After $3.5M Oracle Manipulation Exploit","type":"news_article","url":"https://blockfence.io/nostra-halts-starknet-money-market-after-3-5m-oracle-manipulation-exploit/"}]},{"content":"Nostra Finance was developed by Tempus and described as the liquidity layer of the Starknet ecosystem. The protocol offered lending, borrowing, swapping, and bridging services. It also developed UNO, described as Starknet's first stablecoin backed by USD through over-collateralization with interest-bearing ETH. The protocol launched a liquid staking token, nstSTRK, in March 2024, and distributed its governance token NSTR via airdrop in or around June 2024. David Garai, listed as founder, stepped down as chief executive shortly after the NSTR token airdrop in June 2024. At its peak Nostra managed approximately $55 million in TVL, though the figure had declined significantly by the time of the September 2026 exploit, with the DEX aggregator reporting approximately $3.62 million prior to the incident. No regulatory actions by the SEC, CFTC, or any other government body were identified against Nostra Finance or its principals at the time of this report.","heading":"Protocol Background","severity":"low","sources":[{"credibility":2,"name":"Nostra Finance Explained: Lending Protocol on StarkNet","type":"other","url":"https://www.gate.com/learn/articles/all-you-need-to-know-about--nostra-finance/1410"},{"credibility":3,"name":"Nostra Finance: The Liquidity Layer of StarkNet","type":"other","url":"https://medium.com/@tokenomix/nostra-finance-the-liquidity-layer-of-starknet-9009a7143f17"},{"credibility":2,"name":"Nostra - DeFi Overview, TVL Analysis","type":"on_chain","url":"https://dappradar.com/dapp/nostra"}]}],"sources_used":[{"credibility":2,"name":"Nostra Halts Its Starknet Money Market After a $3.5M NSTR Oracle Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/09/18/nostra-halts-starknet-money-market-after-3-5m-nstr-oracle-exploit/"},{"credibility":2,"name":"Nostra Finance $3.5M Exploit: How an 8,000x Oracle Pump Drained a Starknet Money Market","type":"research","url":"https://dev.to/qanzhi111/nostra-finance-35m-exploit-how-an-8000x-oracle-pump-drained-a-starknet-money-market-2h2l"},{"credibility":2,"name":"Nostra Pauses Market After NSTR Oracle Manipulation","type":"news_article","url":"https://cryptodaily.co.uk/2026/09/nostra-nstr-oracle-manipulation-bridged-ethereum"},{"credibility":2,"name":"Nostra Joins a September That Has Already Cost Crypto Over $326 Million (BeInCrypto)","type":"news_article","url":"https://beincrypto.com/nostra-starknet-oracle-exploit-market-paused/"},{"credibility":2,"name":"Nostra Halts Starknet Money Market After $3.5M Oracle Manipulation Exploit","type":"news_article","url":"https://blockfence.io/nostra-halts-starknet-money-market-after-3-5m-oracle-manipulation-exploit/"},{"credibility":2,"name":"Nostra hit by $3.5M Oracle attack as security concerns re-emerge","type":"news_article","url":"https://ambcrypto.com/nostra-hit-by-3-5m-oracle-attack-as-security-concerns-re-emerge-details/"},{"credibility":2,"name":"Nostra Finance Exploit Highlights Starknet DeFi Vulnerability","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/18/nostra-finance-exploit/"},{"credibility":2,"name":"Nostra Finance Exploit Highlights Starknet DeFi Vulnerability (Bitcoin Ethereum News)","type":"news_article","url":"https://bitcoinethereumnews.com/tech/nostra-finance-exploit-highlights-starknet-defi-vulnerability/"},{"credibility":2,"name":"Nostra Oracle Exploit: $3.5M Borrowed After NSTR Price Manipulation (CoinGabbar)","type":"news_article","url":"https://www.coingabbar.com/en/nostra-oracle-exploit-news-nstr-token-price-manipulation"},{"credibility":2,"name":"Nostra Protocol Exploited for $3.5M via NSTR Oracle Manipulation (Phemex)","type":"news_article","url":"https://phemex.com/news/article/nostra-lending-protocol-drained-of-35m-following-nstr-oracle-manipulation-97049"},{"credibility":2,"name":"Nostra Loses $3.5M in Assets Due to NSTR Oracle Price Manipulation (KuCoin)","type":"news_article","url":"https://www.kucoin.com/news/flash/nostra-loses-3-5m-in-assets-due-to-nstr-oracle-price-manipulation"},{"credibility":2,"name":"Starknet's Nostra Protocol Pauses LST Borrowing After Oracle Error","type":"news_article","url":"https://bitnewsbot.com/starknets-nostra-protocol-pauses-lst-borrowing-after-oracle-error/"},{"credibility":2,"name":"DeFi lending protocol Nostra temporarily suspended borrowing related to xSTRK and sSTRK (Bitget News)","type":"news_article","url":"https://www.bitget.com/news/detail/12560604662412"},{"credibility":2,"name":"Nostra Finance Explained: Lending Protocol on StarkNet (Gate Learn)","type":"other","url":"https://www.gate.com/learn/articles/all-you-need-to-know-about--nostra-finance/1410"},{"credibility":2,"name":"Nostra - DeFi Overview, TVL Analysis (DappRadar)","type":"on_chain","url":"https://dappradar.com/dapp/nostra"},{"credibility":3,"name":"Nostra: Why It has Largest TVL on Starknet (Braavos)","type":"other","url":"https://braavos.app/nostra-finance-starknet-crypto-super-app/"}],"summary":"Nostra Finance is a DeFi lending and borrowing protocol built on Starknet, originally developed by Tempus and described as the liquidity layer of the Starknet ecosystem. On September 17, 2026, the protocol suffered an oracle price manipulation exploit in which an attacker inflated the NSTR governance token price approximately 8,000x and borrowed roughly $3.5 million in assets against artificially inflated collateral. All lending market functions were paused immediately upon detection; as of the time of this report, approximately $1.92 million had been bridged to Ethereum and recovery remained unconfirmed.","timeline":[{"date":"2024-03-01","event":"Nostra launched nstSTRK liquid staking token on Starknet.","source":"Gate Learn — Nostra Finance Explained","source_url":"https://www.gate.com/learn/articles/all-you-need-to-know-about--nostra-finance/1410"},{"date":"2024-06-01","event":"NSTR governance token distributed via airdrop. Founder David Garai stepped down as CEO shortly thereafter.","source":"AMBCrypto — Nostra hit by $3.5M Oracle attack","source_url":"https://ambcrypto.com/nostra-hit-by-3-5m-oracle-attack-as-security-concerns-re-emerge-details/"},{"date":"2025-03-24","event":"Nostra paused borrowing against xSTRK and sSTRK after price feed errors inflated their oracle values approximately three times within a narrow block range. No confirmed financial losses reported.","source":"Bitnewsbot — Starknet's Nostra Protocol Pauses LST Borrowing After Oracle Error","source_url":"https://bitnewsbot.com/starknets-nostra-protocol-pauses-lst-borrowing-after-oracle-error/"},{"date":"2026-09-17","event":"At approximately 05:23 UTC, attacker created a fake NSTR/SolvBTC pool on Starknet with approximately 1.5 SolvBTC of one-sided liquidity and began wash-trading through it.","source":"DEV Community — Nostra Finance $3.5M Exploit","source_url":"https://dev.to/qanzhi111/nostra-finance-35m-exploit-how-an-8000x-oracle-pump-drained-a-starknet-money-market-2h2l"},{"date":"2026-09-17","event":"By approximately 05:47–05:48 UTC, repeated swaps through the thin pool printed NSTR's reported price at approximately $49.50, up from approximately $0.006 — an approximately 8,000x increase.","source":"DEV Community — Nostra Finance $3.5M Exploit","source_url":"https://dev.to/qanzhi111/nostra-finance-35m-exploit-how-an-8000x-oracle-pump-drained-a-starknet-money-market-2h2l"},{"date":"2026-09-17","event":"Between approximately 05:48 and 05:50 UTC, attacker used inflated NSTR as collateral to borrow approximately $3.5 million in ETH, STRK, USDC, USDT, WBTC, and DAI from Nostra's money market.","source":"CryptoTimes — Nostra Halts Its Starknet Money Market","source_url":"https://www.cryptotimes.io/2026/09/18/nostra-halts-starknet-money-market-after-3-5m-nstr-oracle-exploit/"},{"date":"2026-09-17","event":"Borrowed proceeds were routed through AVNU, Ekubo, and JediSwap on Starknet. Nostra detected the exploit and paused all supply, borrow, withdrawal, and liquidation functions.","source":"DEV Community — Nostra Finance $3.5M Exploit","source_url":"https://dev.to/qanzhi111/nostra-finance-35m-exploit-how-an-8000x-oracle-pump-drained-a-starknet-money-market-2h2l"},{"date":"2026-09-18","event":"CertiK reported approximately $1.92 million in assets had been bridged from Starknet to Ethereum, including approximately 234.57 ETH and 1.3 million DAI, arriving at Ethereum address 0xa059aaab82773caf622de9d9a0f2dbf9aa7f3c37. GoPlus Security, PeckShield, CertiK, and SlowMist all independently classified the event as oracle price manipulation.","source":"CryptoDailyUK — Nostra Pauses Market After NSTR Oracle Manipulation","source_url":"https://cryptodaily.co.uk/2026/09/nostra-nstr-oracle-manipulation-bridged-ethereum"},{"date":"2026-09-18","event":"Nostra issued public statement confirming the pause, warning users against wallet-connect scams, and indicating a detailed post-mortem would follow. Final loss figures and recovery status remained unconfirmed.","source":"Blockfence — Nostra Halts Starknet Money Market After $3.5M Oracle Manipulation Exploit","source_url":"https://blockfence.io/nostra-halts-starknet-money-market-after-3-5m-oracle-manipulation-exploit/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 37e778ed-613e-447d-9578-f9cf87f4dea3copy