v1 → v2
Scores
trust_score27 → 27
severity_base— → —
score_modifier-1.4 → -1.4
Sections
September 2026 Oracle Manipulation Exploit
unchanged
Oracle Design Weaknesses Identified
unchanged
Prior Security Incident: March 2025 xSTRK/sSTRK Oracle Error
unchanged
Protocol Status and User Impact
unchanged
Protocol Background
unchanged
Timeline events
No timeline changes.
Accepted submissions
- removedurlincriminating
{"url":"https://www.halborn.com/blog/post/explained-the-nostra-finance-hack-september-2026","title":"On September 17, 2026, Nostra Finance suffered a $3.5 million oracle manipulation exploit. An attacker fabricated a fake NSTR/SolvBTC liquidity pool to hijack GeckoTerminal's pool-selection logic, inflating the NSTR oracle price from ~$0.006 to ~$49.50 (roughly 8,000x). Against this inflated collateral the attacker borrowed approximately $3.5 million in ETH, STRK, USDC, USDT, WBTC, and DAI. Nostra paused all lending functions. PeckShield confirmed ~$1.92 million was bridged to Ethereum. Oracle provider Pragma subsequently flagged six price feeds (BROTHER, DAI, DOG, EKUBO, LORDS, NSTR) as critical risk. This is a major new confirmed exploit on the existing Nostra Finance page.","sources":["https://www.halborn.com/blog/post/explained-the-nostra-finance-hack-september-2026","https://www.cryptotimes.io/2026/09/18/nostra-halts-starknet-money-market-after-3-5m-nstr-oracle-exploit/","https://shattered.io/nostra-finance-3-5-million-pragma-oracle-exploit-2026/","https://www.spendnode.io/blog/pragma-flags-6-price-feeds-critical-risk-starknet-nostra-exploit-september-2026/","https://www.gncrypto.news/news/nostra-halts-market-after-3-5m-oracle-exploit-starknet/"]}Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v1 hash: 5qWw8QMbiusVsByriHKMFj5ZFPDcGP1QM8hCTmRoN3Bj
v2 hash: dacdf05ca26b0feb8f5843a47a9ea791ba08c6cdda83947e4b12f67299c88366