An 8,000x oracle print let one account borrow six times NSTR's entire market cap

Pool selection is where this got cheap. According to GoPlus Security, the attacker hijacked GeckoTerminal's pool-selection logic, and a rigged pool with almost no real depth became the reference source ^[16]. The dev.to write-up argues that many retail-facing and some protocol-adjacent feeds still rank pools by recent volume, displayed liquidity, or whichever pair looks official ^[17]. An attacker who knows those rules can manufacture a reference market for less than it costs to push a deep AMM ^[18]. Wash trading against yourself is a poor way to make money, and at that depth it was a cheap way to write a number into someone else's feed ^[8].

BeInCrypto put NSTR's market value at about $546,751 ^[4]. At the pre-attack price of roughly $0.006, that implies a free float near 91 million tokens ^[2]. Printed at $49.5, the same float marks at about $4.5 billion ^[3]. Nostra held around $4 million of deposits the day before, so for a few minutes the feed was asserting that one illiquid collateral asset outweighed the whole protocol by more than a thousand to one ^[4]. The borrow that followed came to about 6.4 times NSTR's market cap ^[5].

The write-up's own summary of the setup is an illiquid governance token accepted as collateral, an aggregator-selected spot print, no sanity bound and no isolation mode ^[24]. It lists four controls that together would have turned the print into a failed experiment: a time-weighted price across multiple independent venues, a maximum one-block or one-minute deviation, a borrow cap below NSTR's free-float market cap, and isolation so NSTR could not draw on the ETH, USDC and WBTC vaults ^[19]. Two of those are oracle engineering. The other two, the borrow cap and the isolation flag, get set when the asset is approved.

GoPlus Security, PeckShield, CertiK and SlowMist all classified the event as oracle price manipulation; none of the four called it a core-contract reentrancy or an unauthorized mint ^[2]. The write-up's position is that code audits do not catch this class unless their scope reaches past Solidity or Cairo function correctness into economic invariants ^[20]. The account attributes the pool-selection hijack to GeckoTerminal's ranking and does not say which feed Nostra's own contracts read ^[23].

GoPlus's timeline has the borrow wallet touching NSTR contracts in March and August 2026, stacking cheap inventory months ahead of the spike ^[6]. Wash trades ran through the fake pool from 05:27 to 05:47 UTC, and liquidity was pulled from the market-making range ^[8]. Between 05:48 and 05:50 the marked-up collateral was posted and the account drew ETH, STRK, USDC, USDT, WBTC and DAI ^[10]. From 05:51 to 07:08 the proceeds were sold across AVNU, Ekubo and JediSwap, and about 2.2 million STRK left Starknet through the NEAR Intents bridge ^[11].

GoPlus described about $1.9 million sitting in an Ethereum consolidation wallet and roughly $1.5 million still in the borrow account at the time of reporting ^[13]. Those two buckets cover about $3.4 million of the roughly $3.5 million borrowed ^[7]. Moonwell on Base was hit in late August after manipulation of its own token's price ^[21]. Protocol tokens keep getting accepted as collateral because they bootstrap utility for the native token and raise apparent TVL ^[22].