Pragma's 4 September oracle error halved major prices on Starknet and set off 47 liquidations

What happened

At 04:07 UTC on 4 September 2026, Pragma's oracle on Starknet briefly reported that USDT was worth about two dollars. A few seconds later, BTC, ETH, STRK and other major assets suddenly looked like they had lost about half their value.

Vesu, the lending protocol that reads those prices, did what it is built to do. It liquidated borrowers whose collateral now looked too thin. Pragma's reconstruction counts 47 liquidations across 42 borrower wallets in seven pools, all within about two minutes. The real markets had not moved.

Pragma published a post-mortem on 14 September and has updated it since. Its tone is direct: "This was a failure in our pricing system."

What is confirmed

Everything below comes from Pragma's post-mortem unless it says otherwise. Times are UTC on 4 September.

The chain of errors

• Pragma's asset registry mapped USDC to the old bridged USDC.e token instead of native USDC. A price calculation that relied on Ekubo data therefore went through an inactive USDC.e pool, and its stale price relationship produced a USDT/USD observation of about $3.07.
• At 04:07:52, three healthy USDT/USD sources were outside the oracle's 60-minute freshness window. Two values remained: Bitstamp at about $0.99995 and the faulty one at $3.073203. With two values, the median is their average, about $2.0366.
• Pragma's publisher software then read that on-chain USDT price and used it to convert other USDT-quoted prices. BTC, WBTC, ETH, STRK and USDC observations were divided by about 2.04, so they looked roughly halved. Both active publishers ran the same software, so running two did not give two independent opinions.
• A derived feed made things worse. wstETH is computed from ETH on a different update cycle, so for a short time wstETH collateral was valued at half while ETH debt was valued at full price.

Impact, as estimated by Pragma

• Collateral seized: about $3,077,500.
• Debt repaid by liquidators: about $1,674,711.
• Borrower equity lost: about $783,905.
• Bad debt absorbed by pools: about $618,884.
• Liquidator proceeds above debt repaid: about $1,402,789.

Pragma warns that "collateral seized is not the same measure as users' net loss", and that these are early estimates, not a compensation statement.

Response and recovery

• A hotfix, SDK 2.13.1, shipped at 07:59 and stopped the software from reusing its own USDT price to build other feeds.
• The main recovery transfer from the principal liquidator reached the Vesu Security Council multisig on 7 September.
• On 13 September Vesu said asset recovery was complete: about $1,330,279 recovered at 11 September prices, a 95% recovery rate (93% at prices from the morning of the incident). Pragma stresses this uses a different price basis from its own estimates and does not mean 95% of each position came back.
• Each pool curator holds its recovered funds and decides how to refund. As of 17 September, Pragma said Vesu had not announced that all curator refunds were finished.
• Pragma moved administration of its oracle and publisher registry to a 3-of-5 multisig on 22 September, replacing a single admin key.

How it worked

Think of a price oracle as a panel of witnesses. The oracle takes a median, so one bad witness gets outvoted. That works until the panel shrinks.

Three problems lined up.

First, one witness was reading from an old, nearly dead pool because of a wrong token mapping, and so produced a nonsense USDT price. Normally that would be outvoted.

Second, a freshness filter threw out three honest witnesses for being a little old, leaving only two. With two witnesses, a median is just an average, and an average is easy to drag.

Third, and most damaging, the software trusted its own wrong answer. USDT is used to translate prices from exchanges that quote in USDT into dollars. When that conversion was wrong, every price that depended on it was wrong in the same direction, and by the same factor, even though many different exchanges supplied the underlying numbers. Those observations looked independent, and were not.

Vesu does have a minimum-source check. It rejected the two-source USDT feed. But it saw large source counts for BTC and ETH, and nothing told it that those feeds relied on a weak conversion input. Pragma says its reporting of source counts did not expose that shared dependency and calls that its own responsibility.

What is not known

• The final amount users lose after refunds. It depends on curator decisions and on which liquidators returned funds. Some liquidators could not be identified or reached.
• Whether every curator has finished refunding. The post-mortem's latest update, dated 23 September, says follow-up is open.
• Whether all publishers have rolled out the fixed software. Pragma says the configuration was merged on 15 September and runtime verification across publishers is still open.
• When Pragma's fix for composed-price source-count reporting will ship. It is listed as pending.

Lessons

• Redundancy is not independence. Two operators running the same code can produce one error twice.
• Count what really backs a price. A number of sources means little if they all pass through one conversion.
• Be careful with freshness filters. Dropping stale inputs without a floor can leave a weaker panel than you think.
• Check derived assets against their base. If wstETH and ETH update at different times, lending code can briefly see a nonsense ratio.
• Do not let an oracle consume its own output. Pragma's fix cut that loop.
• Verify the monitors too. In the follow-up Pragma found a reorg could freeze its deviation checks while indexing continued.

What users should do

If you were liquidated on Vesu on 4 September, contact your pool's curator through Vesu's official channels. Lenders who still hold an affected position get a top-up to the pool reserve with no action. Lenders who left after absorbing losses, and liquidated borrowers, should ask for a direct refund.

Vesu and its curators say they will never ask you to connect a wallet or sign a message to claim a refund. Treat anyone who does as a scammer.

Sources: Pragma's post-mortem, which also summarises Vesu's recovery update. We have not checked the on-chain data ourselves.