TLDR
- A bad Pragma price feed caused 47 positions to be wrongly liquidated on Vesu on September 4
- Around $3 million in collateral was affected in just two minutes
- Vesu says its smart contracts worked correctly and had no vulnerability
- Pragma has deployed a fix and affected pools have been suspended as a precaution
- Vesu is working with Starknet organizations to recover funds for affected users
A faulty oracle price feed on the Starknet lending protocol Vesu triggered the abnormal liquidation of 47 positions worth $3 million in collateral on September 4, 2026.
🚨 Update on the 4th September oracle incident
A faulty upstream Pragma price feed caused 47 positions and $3M of collateral to be irregularly liquidated across several Vesu pools between 04:08 and 04:10 UTC
The feed corrected itself within two minutes, and nothing has been…
— Vesu (@vesuxyz) September 4, 2026
The incident lasted just two minutes, between 04:08 and 04:10 UTC, but caused widespread disruption across several of Vesu’s liquidity pools.
What Went Wrong
Vesu uses an external price feed provided by Pragma to monitor the health of borrowing positions. When that feed supplied incorrect data, Vesu’s liquidation engine flagged 47 positions as eligible for liquidation.
Automated liquidators then removed approximately $3 million in collateral before the feed corrected itself. The incorrect prices lasted less than two minutes before returning to accurate market values.
Vesu did not disclose which assets were affected, how far the prices differed from real market rates, or how much collateral the liquidators retained. A full technical report is expected to provide more detail.
Vesu Says Its Contracts Were Not at Fault
Vesu was clear that its smart contracts were “operating as designed” and contained no vulnerability. The protocol said it had nothing to patch because the liquidation engine simply processed the bad data it received from the oracle.
In an overcollateralized lending market, borrowers deposit assets worth more than their loan. The protocol checks the ratio of collateral to debt using an external price feed. If a faulty feed shows that ratio dropping below the required level, liquidations begin automatically.
Vesu attributed the September 4 event to bad inputs, not faulty execution.
Recovery Efforts Underway
Following the incident, Vesu began coordinating with Pragma, StarkWare, the Starknet Foundation, and the curators of the affected pools to try to recover the funds.
Vesu has not yet explained how much of the $3 million can be recovered or whether liquidators have agreed to return any assets. No guaranteed reimbursement amount or payment date has been announced.
Users who had positions liquidated during the two-minute window were asked to open a support ticket on Vesu’s Discord. Earn product users were advised to keep their positions open, as closing them early could affect refund eligibility.
How This Compares to Past Oracle Failures
Oracle failures in DeFi are not new. A similar event occurred on Aave in March 2026, when a stale parameter caused an estimated $26 to $27 million in unintended wstETH liquidations. Aave later reviewed its oracle update rates and fallback systems.
Vesu has not announced any changes to its oracle setup beyond Pragma’s root-cause fix.
Smart contracts cannot read off-chain market prices on their own. They rely entirely on oracle systems to source, aggregate, and deliver price data on-chain. A failure at any stage can trigger incorrect trades or liquidations.
Vesu said a complete technical report will follow its investigation.
