v4 → v5
Scores
trust_score26 → 26
severity_base27 → 27
score_modifier-1.4 → -1.4
Sections
September 2026 Oracle Manipulation Exploit
unchanged
Oracle Design Weaknesses Identified
unchanged
Prior Security Incident: March 2025 xSTRK/sSTRK Oracle Error
unchanged
Protocol Status and User Impact
unchanged
Protocol Background
unchanged
Timeline events
No timeline changes.
Accepted submissions
+ addedurlincriminating
{"url":"https://www.halborn.com/blog/post/explained-the-nostra-finance-hack-september-2026","title":"On September 17, 2026, Nostra Finance suffered a $3.5 million oracle manipulation exploit. An attacker fabricated a fake NSTR/SolvBTC liquidity pool to hijack GeckoTerminal's pool-selection logic, inflating the NSTR oracle price from ~$0.006 to ~$49.50 (roughly 8,000x). Against this inflated collateral the attacker borrowed approximately $3.5 million in ETH, STRK, USDC, USDT, WBTC, and DAI. Nostra paused all lending functions. PeckShield confirmed ~$1.92 million was bridged to Ethereum. Oracle provider Pragma subsequently flagged six price feeds (BROTHER, DAI, DOG, EKUBO, LORDS, NSTR) as critical risk. This is a major new confirmed exploit on the existing Nostra Finance page.","sources":["https://www.halborn.com/blog/post/explained-the-nostra-finance-hack-september-2026","https://www.cryptotimes.io/2026/09/18/nostra-halts-starknet-money-market-after-3-5m-nstr-oracle-exploit/","https://shattered.io/nostra-finance-3-5-million-pragma-oracle-exploit-2026/","https://www.spendnode.io/blog/pragma-flags-6-price-feeds-critical-risk-starknet-nostra-exploit-september-2026/","https://www.gncrypto.news/news/nostra-halts-market-after-3-5m-oracle-exploit-starknet/"]}Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v4 hash: ed58993e4fd6c2ce97557684ae8e6c292d11074d4643bb655a0a6b474915ef05
v5 hash: 5deLm2P9Gppp6jTyNhSB6dde9d2xERMEBN7mnzAM1ETq