Vesu Protocol Faces $3M Liquidation Crisis After Pragma Oracle Malfunction

Key Takeaways Forty-seven user positions were incorrectly liquidated on Vesu due to erroneous Pragma oracle data on September 4 Approximately $3 million in user collateral was impacted during a brief two-minute window The protocol confirms its smart contracts functioned as intended with no security flaws Pragma has implemented a resolution and impacted liquidity pools remain temporarily paused Collaborative recovery initiatives involving Starknet partners are in progress for impacted users On September 4, 2026, the Starknet-based lending platform Vesu experienced an oracle-related incident that resulted in the improper liquidation of 47 user positions, affecting roughly $3 million in collateral assets. Update on the 4th September oracle incident A faulty upstream Pragma price feed caused 47 positions and $3M of collateral to be irregularly liquidated across several Vesu pools between 04:08 and 04:10 UTC The feed corrected itself within two minutes, and nothing has been… — Vesu (@vesuxyz) September 4, 2026 The malfunction occurred within an exceptionally narrow timeframe—from 04:08 to 04:10 UTC—yet managed to create significant turmoil across multiple liquidity pools operating on the protocol. Root Cause of the Incident The protocol relies on Pragma, an external oracle service, to deliver accurate price information for assessing the health status of borrowing positions. When Pragma’s feed transmitted erroneous pricing data, Vesu’s automated liquidation mechanism identified 47 positions as undercollateralized and eligible for liquidation. Automated bots executed liquidations, seizing approximately $3 million worth of collateral before the oracle data self-corrected. The pricing anomaly persisted for under two minutes before accurate market valuations resumed. The protocol has not yet revealed which specific assets experienced pricing errors, the magnitude of price deviations from actual market rates, or the exact amount of collateral retained by liquidation bots. A comprehensive technical post-mortem is anticipated to address these questions. Protocol Maintains Smart Contract Integrity Vesu emphasized that its underlying smart contract infrastructure was “functioning exactly as programmed” and harbored no exploitable weaknesses. According to the team, no protocol-level patches were necessary since the liquidation system merely responded to compromised data received from the oracle provider. Within overcollateralized lending systems, users must deposit assets exceeding the value of their borrowed funds. The protocol continuously monitors the collateral-to-debt ratio using externally sourced price information. When a compromised feed incorrectly indicates this ratio has fallen below safety thresholds, automatic liquidation procedures activate. The team maintains that the September 4 event stemmed from corrupted input data rather than flawed contract logic. Fund Recovery Initiatives in Motion In response to the incident, Vesu initiated coordination efforts with Pragma, StarkWare, the Starknet Foundation, and pool curators to attempt fund recovery for affected parties. The protocol has not disclosed what portion of the $3 million might be recoverable or whether liquidation bot operators have committed to returning seized assets.