A faulty Pragma oracle feed on Starknet sent 47 Vesu borrowing positions to liquidation in a two-minute window, wiping out roughly $3 million in collateral. Vesu says its contracts did exactly what they were supposed to do. The bad input was the problem.
- 47 borrowing positions were hit
- About $3 million in collateral was liquidated
- Vesu blames bad oracle data, not a contract exploit
- Recovery is unresolved and no reimbursement plan has been announced
Vesu, a Starknet-based lending protocol, disclosed on Sept. 5 that a faulty Pragma price feed triggered liquidations between 04:08 and 04:10 UTC on Sept. 4. The protocol says incorrect prices briefly made 47 borrowing positions eligible for liquidation before the feed corrected itself within two minutes.
That distinction matters. In DeFi, an oracle is the outside data source that feeds market prices into smart contracts. If the price feed is wrong, the contract can still execute perfectly and still produce a disastrous result. The code may be fine. The outcome may still be ugly.
Vesu said its contracts were “operating as designed” and that there was no vulnerability in the liquidation engine. The protocol also said it had “no contract patch to deploy” because the engine simply responded to the prices it received.
That is technically a clean explanation, but it is not the same thing as saying users were protected. A smart contract can be obedient and still be merciless. DeFi does not hand out mercy with the block reward.
The protocol did not identify the affected assets in its initial disclosure. It also left out several details that matter for a full damage assessment: the size of the price deviation from market rates, the debt attached to the liquidated positions, how much collateral liquidators kept, and a pool-by-pool breakdown.
A technical report is expected later. Until then, the public picture is partial: we know the timing, the rough size of the hit, and the cause Vesu points to. We do not yet know the full mechanics of how the failure unfolded.
According to Vesu, the issue came from a faulty Pragma price feed, and Pragma worked with relevant organizations to deploy a fix for the source of the error. Liquidity pool curators suspended the affected pools as a precaution.
That curator model is part of how Vesu is built. It uses isolated and curated lending pools, which means each market can be managed separately. That can limit contagion, but it also means recovery and reopening are not a single switch the protocol flips. More hands in the process can mean more checks. It can also mean more delay, more coordination, and more room for finger-pointing.
Vesu said it is coordinating with Pragma, StarkWare, the Starknet Foundation, and affected pool curators to try to recover funds. What that actually turns into is still unclear. The protocol has not said how recovery will work, how much of the $3 million might be recoverable, whether liquidators will return assets voluntarily, or whether reimbursement is guaranteed.
That uncertainty is the real mess here. Blockchain transactions are generally final after confirmation, so reversing a liquidation is not as simple as pressing undo. Any compensation would likely have to come from recovered assets, voluntary returns, protocol funds, or some separate arrangement.
There is no FDIC-style safety net for on-chain lending positions. FDIC insurance covers eligible bank deposits, not DeFi collateral. That is the tradeoff users take on when they chase open, permissionless finance: more freedom, less babysitting, and absolutely no promise that the system will make you whole when something goes sideways.
Vesu told users in its Earn product to keep positions open, which suggests closing them could affect eligibility for any possible refund. Borrowers liquidated during the window were told to open a support ticket through Vesu’s Discord server.
This is not a one-off lesson either. Oracle failures are a known DeFi risk because lending markets depend on accurate prices to calculate collateral ratios and health factors. If the feed is stale, glitchy, or malformed, a protocol can liquidate healthy positions or miss risky ones. The contract may be behaving exactly as programmed, but the system still fails where it counts.
There is also a useful comparison from elsewhere in DeFi. In March 2026, Aave experienced an estimated $26 million to $27 million in unintended wstETH liquidations caused by a stale parameter, according to a crypto.news report cited in the source material. The mechanics were not identical, but the lesson is the same: a system can execute correctly on bad data and still create a very expensive problem.
Starknet has also identified Vesu as one of the protocols supporting its STRK20 privacy rollout, alongside avnu, Ekubo, and Endur. That adds another reminder that ecosystem polish does not erase oracle risk. Privacy, scalability, and composability are useful. None of them stop a bad price feed from torching a lending market.
All Roads Lead to Panic: A Starknet Oracle Story
What Vesu has not announced, at least in its initial disclosure, is any comparable overhaul of its oracle structure. That may change once the technical report lands, but for now the focus is on containment and recovery rather than redesign.
The uncomfortable truth is simple: “operating as designed” is not the same thing as “users are safe.” In DeFi, that gap is where the pain lives.
Vesu Reports $3 Million Liquidation Due to Oracle Failure
Vesu Traces $3M Liquidation to Pragma Price Feed
Nereus Finance - Projects & Protocols
Boyaa Interactive Q1 2026 Net Loss Surpasses $60M Amid
Starknet Mainnet Outage: Ethereum L2 Down for 2+ Hours
Ethereum’s Holesky Testnet Reaches Finality, Pectra Upgrade
Crypto Watchlist: 5 Critical Catalysts Impacting Bitcoin
Key takeaways
-
Was Vesu hacked?
No clear smart contract exploit has been identified. Vesu says its contracts were operating as designed, and the problem came from faulty oracle data. -
What caused the liquidations?
A bad Pragma price feed supplied incorrect prices between 04:08 and 04:10 UTC on Sept. 4, making 47 borrowing positions eligible for liquidation. -
How much was affected?
Vesu says about $3 million in collateral was liquidated during the two-minute window. -
Can affected users expect automatic reimbursement?
No automatic reimbursement has been announced. Any recovery would likely depend on returned assets, recovered funds, protocol resources, or another negotiated arrangement. -
Why does this matter beyond Vesu?
Because oracle failures are a recurring weakness in DeFi lending. Even when smart contracts work exactly as written, bad price data can still cause real losses.
