Nostra Finance, a money market protocol built on Starknet, suspended deposits, loans and liquidations on Wednesday after an attacker manipulated its price oracle to borrow approximately $3.5 million against artificially inflated collateral.
The attack, dated September 17 and documented by GoPlus Security, centred on the platform's native NSTR token. Before the exploit, NSTR traded at roughly $0.006. Within minutes, its reported price surged to $49.5, an increase of nearly 8,000 times, allowing the attacker to post NSTR as collateral of far greater apparent value than it actually held and draw down a range of assets from the protocol.
GoPlus Security classified the incident as a low-liquidity oracle failure. According to its account, the attacker created a new NSTR/SolvBTC liquidity pool at 05:23 on September 17, funding it with 1.5 SolvBTC in unilateral liquidity. Between 05:27 and 05:47, the attacker engaged in wash trading before withdrawing liquidity from the pool. A swap executed between 05:47 and 05:48 pushed the reported NSTR price to $49.5, exploiting a mechanism in which GeckoTerminal's pool selection could be hijacked through a thinly traded pair.
Rapid withdrawal and dispersal
With the inflated valuation in place, the attacker withdrew a mix of assets, including ETH, STRK, USDC, USDT, WBTC and DAI, worth around $3.5 million between 05:48 and 05:50. The funds were then sold across decentralised exchanges AVNU, Ekubo and JediSwap between 05:51 and 07:08.
Part of the proceeds, 2.2 million STRK, was bridged off-chain via the NEAR Intents bridge. GoPlus Security traced the flow through two transit wallets, one receiving 1.2 million STRK and the other 1.0 million STRK, before proceeds were consolidated around September 18. An Ethereum-based wallet linked to the attacker is said to hold approximately $1.9 million, while roughly $1.5 million remains in the account originally used to take out the loans.
GoPlus Security noted that the attacker's wallet had interacted with NSTR contracts months before the exploit, accumulating tokens at low prices during that period. The eventual cost of mounting the attack is estimated at around 1.5 SolvBTC plus the previously accumulated, low-cost NSTR holdings, a modest outlay relative to the reported $3.5 million extracted.
Platform response
Nostra Finance has fully suspended deposits, loans and liquidations across its money market following the disclosure. The protocol operates on Starknet, a layer-2 network built to scale Ethereum, and the incident adds to a series of oracle-related exploits that have affected decentralised finance platforms relying on thinly traded token pairs for price discovery.
