- NSTR-100Negative
GoPlus Security 🚦 (@GoPlusSecurity)
⚠️ Exploit breakdown: oracle manipulation on Nostra Finance On Sept 17, the @nostrafinance money market on #Starknet was hit with an oracle price-manipulation attack. About $3.5M was borrowed out against inflated collateral. The attacker pumped the NSTR oracle from ~$0.006 to $49.5 — roughly 8,000x — then used the overvalued NSTR as collateral to drain other assets. The money market is fully paused. Supply, borrow, and liquidations are all offline. 🔍 Attack flow ▪️ Months earlier (Mar / Aug): accumulated NSTR and pre-positioned collateral 0x06d48ef7 ▪️ Sept 17, 05:23: created a fake NSTR/SolvBTC pool with 1.5 SolvBTC one-sided liquidity and hijacked GeckoTerminal’s pool selection 0x3aa300d2 ▪️ 05:27–05:47: wash traded the pool and pulled liquidity from the market-making range 0x2d9fb4ed ▪️ 05:47–05:48: swapped through the thin pool and spiked the price to $49.5 0x2d9fb4ed ▪️ 05:48–05:50: borrowed out ETH / STRK / USDC / USDT / WBTC / DAI, ~$3.5M 0x06d48ef7 ▪️ 05:51–07:08: dumped via AVNU / Ekubo / JediSwap; 2.2M STRK left the chain through NEAR Intents 0x06d48ef7 ▪️ Around Sept 18: funds consolidated 0xa059aaab 💡 This is a classic low-liquidity oracle failure: 1️⃣ A illiquid token was accepted as collateral 2️⃣ The price feed relied on a third-party source — the attacker appears to have added surface liquidity so GeckoTerminal picked the rigged NSTR pool 3️⃣ Cost of attack: ~1.5 SolvBTC plus NSTR stacked months earlier at cheap prices 📌 Attacker wallets ▪️ Borrow account 0x06d48ef7ab62c26e3ef1987c322096cd508e9034c82048783a6b438fc1344bc3 6 borrows + ~80 sells. Interacted with NSTR contracts in Mar and Aug 2026 — this was staged months ahead. ▪️ Manipulation account 0x2d9fb4edec9d5c015c43514ca5a309aab1b2638c3a45ad750d09ee971d0da23 Ran the pump/dump flow. ▪️ Transit wallets 0x0285b4bf99e227c4baed7f9a8c7c673771fe0b75e897f7350729e3e13021321d — received 1.2M STRK 0x074f5318f8d60ad0832068dc0430d0a0e2f9dd0c2e710fb8c032945a3804b57e — received 1.0M STRK Both immediately bridged out via NEAR Intents. ▪️ Ethereum consolidation 0xA059Aaab82773CAf622DE9d9A0F2dBF9Aa7F3c37 — ~$1.9M Another ~$1.5M is still sitting in the borrow account. ▪️ Sample txs https://voyager.online/tx/0x2460fde607d09f2434d1b4e6d4089c6e1f459f4ce70ba2853d3a37547cdf00e https://voyager.online/tx/0x79005742a8f7fe443a4a0d444f053ba06a49a15d558662404aa894479ddb820