Vesu oracle incident triggers $3M in liquidations

Starknet lending protocol Vesu has reported that a faulty Pragma price feed triggered the abnormal liquidation of 47 positions holding $3 million in collateral on Sept. 4. Summary 47 Vesu positions were liquidated across several pools during a two-minute oracle failure. $3 million in collateral was affected before the Pragma price feed corrected itself. Vesu said its contracts worked as programmed and contained no protocol vulnerability. Vesu and other Starknet organizations are trying to recover funds for affected users. Vesu traces $3M liquidation to Pragma price feed Vesu said in a Sept. 5 incident disclosure that the liquidations occurred between 04:08 and 04:10 UTC on Sept. 4 after an upstream price source operated by Pragma supplied incorrect data. https://twitter.com/vesuxyz/status/2095920738914226512 During the two-minute incident, the faulty prices reached several Vesu liquidity pools and made 47 borrowing positions appear eligible for liquidation. Automated liquidators then removed approximately $3 million in collateral before the feed returned to the correct value. According to the protocol, the price source corrected itself within two minutes and has operated normally since then. Vesu did not identify the affected assets or provide a pool-by-pool breakdown in its initial statement. The company also did not disclose how far the incorrect prices differed from market rates, the amount of debt attached to the liquidated positions, or how much collateral liquidators retained. A technical report covering the incident is expected to provide more information about the affected markets and the sequence of on-chain transactions. You might also like: Tectonic’s $75M exploit was not an oracle failure, RedStone co-founder says Pragma has since worked with the relevant organizations to deploy a fix addressing the source of the error, Vesu said. Liquidity pool curators suspended affected pools as a precaution, with Vesu expecting them to remove the restrictions after reviewing the fix. Because Vesu uses isolated and curated lending pools, decisions on reopening individual markets rest with their curators. The initial update did not identify which curators had paused their pools or provide an exact timetable for restoring normal activity. Vesu says its contracts contained no vulnerability Separating the incident from a smart contract exploit, Vesu said its contracts were “operating as designed” and did not contain a vulnerability. The protocol added that it had no contract patch to deploy because the liquidation engine responded to the prices it received. In an overcollateralized lending market, a borrower deposits assets worth more than the value of a loan. The protocol uses an external price feed to measure the collateral ratio, and a liquidation may begin when that ratio falls below the pool’s required level. Vesu attributed the Sept. 4 liquidations to bad inputs rather than faulty execution.