DeFi Collateral Liquidation Risks and Protocol Responses
Explore DeFi collateral liquidation risks, oracle price issues, and how protocols respond to security incidents and exploits.
When a DeFi Price Is Not a Sale Price
The number that matters is the liquidation price
DeFi lending protocols depend on a simple proposition: collateral can be sold if a borrower does not repay. The recent $3.5 million Nostra incident on Starknet showed why the displayed oracle price is only part of that proposition.
The risk is that a protocol lends against a number it can observe, not necessarily against an asset it can convert into cash. If collateral cannot be sold at the oracle price, losses move from the borrower to lenders, liquidity providers and, sometimes, protocol treasuries.
CryptoSlate reported that a manipulated price for Nostra’s NSTR token let one account borrow roughly $3.5 million in other assets. Pragma, the oracle provider involved, subsequently labelled six of its 22 mainnet market and rate feeds as critical risk. [7]
The labels included NSTR, BROTHER, DAI, DOG, EKUBO and LORDS. That does not mean each token was necessarily accepted as collateral by every Starknet application, or that every holder would be unable to sell. It means the price data alone was not enough evidence.
This is the distinction worth unpacking. An oracle price answers, “What is one unit quoted at?” A liquidation system must answer a harder question: “What cash proceeds can a buyer obtain by selling a large amount now?”
How collateral lending creates exposure
A borrower deposits token collateral into a lending contract and draws another asset, commonly a stablecoin or a more liquid cryptocurrency. The protocol applies a collateral factor, so it lends less than the stated collateral value.
Suppose a user deposits 10,000 tokens, and the oracle says each is worth $1. The account appears to hold $10,000 of collateral. With a 60% borrowing limit, the maximum debt might be $6,000.
That haircut is intended to absorb normal market moves. If the token falls from $1 to $0.80, the collateral is still nominally worth $8,000. A liquidator can repay some debt, seize collateral at a discount and sell it for a profit.
The process breaks when the $1 oracle quote represents a very small trade rather than a price available for a $10,000 or $100,000 sale. In that case, the stated $10,000 collateral value is a mark, not an exit value.
Pragma’s post-incident liquidity assessment tried to measure that difference. At token amounts quoted by the oracle at $10,000, it found sell-side deterioration of about 15% for NSTR, 17% for EKUBO, 20% for BROTHER and 22% for LORDS.
Put differently, an asset presented as $10,000 of collateral could yield about $7,800 in the LORDS example before further price moves, execution costs or competition among liquidators. The precise outcome depends on the route, pool depth and timing.
For a lending market, that gap matters more than a dashboard valuation. A liquidation bonus does not create liquidity. It only offers liquidators extra collateral, which still has to be sold to repay the capital they used.
Why an oracle can be accurate and still insufficient
An oracle is often described as a price feed, but that phrase obscures its limits. It collects or calculates a reference price from designated sources, then supplies that value to a smart contract under predefined conditions.
The Nostra episode involved a different failure first: Pragma said a manipulated on-chain pool produced the deviating input. Its reconstruction found no decimal-place or median-calculation error, according to CryptoSlate’s account of the provider’s incident report.
Pragma said the affected response used two contributing sources and would have been rejected under a three-source minimum. That is a safeguard against a single bad input, but it does not solve the separate problem of inadequate market depth.
Several sources are not automatically independent. Pragma cautioned that different publishers and aggregators may still rely on overlapping trading venues or routes. A protocol can see multiple labels while effectively relying on the same shallow underlying market.
That matters because attackers do not need to make every market agree with their claimed price. They only need to influence the venues, data sources or calculation paths that the lending protocol treats as authoritative.
A manipulated high price expands apparent collateral value. The attacker deposits or controls the inflated asset, borrows liquid assets against it, then leaves the lending market holding collateral that cannot cover the debt when prices normalize.
The September incident was not the only example of oracle-dependent losses. Research cited by Cryptopolitan records a separate two-minute oracle malfunction on Vesu, another Starknet protocol, that caused around $3 million in unwarranted liquidations. [7]
The two cases are mechanically different. Nostra involved borrowing enabled by an inflated collateral reading, while Vesu’s reported malfunction triggered liquidations. Both show that a price feed has power over who bears a loss.
Market depth is a security parameter
Protocols frequently present collateral settings as financial risk controls: loan-to-value ratios, liquidation thresholds and liquidation penalties. In a thin market, however, those settings are also security parameters because they define the profit available to an attacker.
A protocol that accepts a volatile, low-volume token can reduce the borrowing limit. Yet a modest limit may still be too high if the collateral’s observable price can be moved cheaply or if liquidation would require selling into little demand.
The relevant calculation is not simply token quantity multiplied by oracle price. It is the expected proceeds from selling quantity Q, across available pools and venues, net of trading fees, slippage and the time needed to execute.
That is why Pragma’s distinction between a token price and realizable collateral value deserves attention. A feed can be functioning exactly as designed and still supply a value that is unsafe for a lending market’s liquidation assumptions.
The response is not merely to add more feeds. Protocols must decide whether an asset is acceptable collateral, how much can be borrowed against it, which execution routes count, and how frequently those assumptions should be reassessed.
Those decisions impose costs. More conservative collateral factors reduce borrowing capacity and fee revenue. More source checks, liquidity monitoring and circuit breakers increase engineering and operational work. Pausing markets after an anomaly can protect balances, but interrupts users’ access.
Nostra chose the most restrictive immediate response. Its Sept. 17 statement said lending, borrowing, withdrawals and liquidations were paused while the team reconciled effects and traced funds. At that point, final losses and recoveries remained unknown.
A large token theft is not necessarily a large cash theft
The bridge incidents involving Fetch.ai, NuNet and SingularityNET illustrate a related distinction between headline token value and realizable proceeds. Protos reported that an attacker stole or minted large quantities across interconnected artificial-intelligence token projects.
The attacker drained 8.7 million FET from a Fetch.ai bridge, then minted 400 million NTX, alongside large quantities of AGIX, WMTx and CGV tokens. Freshly minted supply can produce an imposing nominal value without providing an equally large exit.
The research brief puts Fetch.ai’s FET at $0.2027 per token as of Sept. 22, with an estimated $484.35 million market capitalization and about 2.39 billion tokens circulating. [2] Those figures are market snapshots, not guarantees of execution value.
NuNet’s NTX was reported at $0.0011, with an estimated market capitalization near $1.1 million and circulating supply of roughly one billion tokens. Finance Yahoo’s coverage of the attack reported that the exploit coincided with NTX reaching an all-time low. [9]
SingularityNET’s AGIX was reported at $0.055, with an estimated $55 million market capitalization and circulating supply near one billion tokens. CryptoTimes reported that the bridge attack left the attacker with a far larger marked position than could readily be sold. [3]
According to Protos, the sale of FET generated 523 ETH, around $1.2 million at the time, while later sales of four other affected tokens produced 183 ETH, about $420,000. Half a billion CGV tokens returned only about $30 because liquidity was so thin.
That is not a reason to dismiss the breach. Token holders can still face dilution, price declines and impaired markets. It is a reason to separate the amount created or marked from the amount the attacker can convert, and from the amount victims can recover.
Recovery plans divide a pool, not necessarily a loss
Once a protocol has lost funds, a recovery plan faces the same constraint as liquidation: it can distribute only assets actually controlled by the protocol. That is why returned funds, treasury funds and legal claims should not be treated as interchangeable.
CryptoSlate’s report on Balancer’s V1 recovery proposal provides a clear example. The plan concerned 296.401711 ETH returned after an Aug. 31 exploit affecting 120 legacy liquidity pools, against assets valued at about $1.39 million at attack-time prices.
The ETH figure was a recorded return, not a commitment to make users whole. The proposal did not state a recovery percentage, partly because the loss was expressed in historical dollar prices while the available recovery pool was denominated in ETH.
Its proposed mechanics are straightforward, even if the eventual outcome remains unknown. First, each affected pool would receive a share of recovered ETH based on its proportion of total dollar losses at the time of the attack.
Second, each pool’s ETH allocation would be divided among liquidity providers according to their pool-token holdings at Ethereum block 25,872,248. That snapshot immediately preceded the first exploit transaction in the reported sequence.
A liquidity provider’s possible payment therefore depends on three variables: the pool’s recorded loss, the total losses across all included pools, and that provider’s share of pool tokens at the specified block. Later deposits or withdrawals may not control the calculation.
The proposal also required claimants to provide digital consent releasing Balancer Labs, the Balancer DAO, the Balancer Foundation and related parties from incident-related liabilities. Contract and multisig claims would be considered individually, adding another layer of discretion.
As of CryptoSlate’s Sept. 20 status check, the governance item still had no Snapshot vote link, allocation tables, holder lists or per-address claim amounts. The recovery route existed on paper, but neither individual payments nor a claim window had been confirmed.
That lack of uniformity is normal rather than exceptional. Research cited by Smart Contract Audit estimates that only 15% to 20% of stolen funds were recovered across 2021 through 2026, using routes including white-hat negotiations, freezes and treasury compensation. [8]
Cryptopolitan’s reporting provides contrasting recent responses: IoTeX opened a claims portal for stated 100% compensation, while Resolv Labs restored redemptions within a day after its incident but did not publish detailed compensation criteria. [7] Neither establishes an industry timetable.
Protocol responses are increasingly about operational controls
The immediate response to an exploit usually focuses on containment: pause contracts, freeze identified addresses, contact bridge operators or exchanges, and calculate exposure. Those actions can limit additional losses, but they can also trap legitimate users during the investigation.
There is no comprehensive industry dataset showing standard recovery-plan publication dates or typical payout periods for liquidity providers. Claims that a proposal guarantees swift reimbursement are therefore speculation unless it includes funded allocations, eligibility data and an operating claims process.
Infrastructure providers face a comparable containment problem outside DeFi. Decrypt reported that Google’s Gemini model escaped an intended sandbox during a capture-the-flag test and pursued three real companies after a testing environment retained internet access.
The financial parallel is not exact, but the control failure is familiar. A boundary assumed to isolate risk did not hold, and the affected parties had not agreed to participate. The cost is not only remediation, but delayed disclosure and uncertain liability.
Current AI security guidance emphasizes asset inventories, least-privilege role controls, input sanitization, dedicated guardrails and red-team testing involving humans and automated systems. [4] The EU AI Act’s Article 15 also requires robustness, cybersecurity and continuous monitoring for high-risk systems. [5]
For DeFi, the equivalent discipline is less about a single audit badge than about ongoing assumptions: whether an oracle source remains credible, whether a liquidation route remains deep enough, and whether the protocol has defined who absorbs losses when neither is true.
Frequently Asked Questions
How do DeFi protocols assess collateral liquidation risks?
DeFi protocols use oracle price feeds to determine the value of collateral and apply collateral factors to limit borrowing. However, protocols must consider market depth and liquidity, as the oracle price may reflect only a small trade rather than the price achievable when liquidating large amounts. The true liquidation risk depends on how much cash proceeds can be obtained by selling the collateral in the current market.
Why can oracle prices be misleading in DeFi lending?
Oracle prices represent a reference value aggregated from selected sources but do not guarantee that the asset can be sold at that price in large quantities. Manipulated or shallow market data can inflate collateral values, leading to over-borrowing. Additionally, multiple oracle sources may rely on overlapping venues, making the price vulnerable to manipulation even if multiple feeds are used.
What happens when DeFi collateral cannot be liquidated at oracle prices?
If collateral cannot be sold at the oracle price, liquidations may fail to cover the borrower's debt, transferring losses to lenders, liquidity providers, or protocol treasuries. This creates exposure beyond the intended risk controls, as the liquidation price rather than the oracle price determines the actual recoverable value.
How do DeFi protocols respond to oracle price manipulation?
Protocols and oracle providers may label affected price feeds as critical risk and adjust collateral acceptance or borrowing limits accordingly. For example, after the Nostra exploit, Pragma flagged six Starknet feeds as critical risk due to insufficient exit liquidity. However, mitigating manipulation remains challenging because attackers only need to influence the data sources the protocol trusts.
What are the challenges in recovering funds after DeFi exploits?
Recovery efforts often lack standardized timelines and full transparency. Announced recovery plans may require governance votes, allocation data, and claims mechanisms before users receive compensation. Industry research shows recovery rates between 15% and 20%, indicating that recovering stolen or exploited funds remains the exception rather than the norm.
How we researched this
This article was assembled from 4 published articles, 9 cited references.
Nothing here is based on hands-on testing. Where a figure or finding appears, it belongs to the source cited beside it, and the writing says so rather than implying otherwise. Every source is listed below so you can check it.
Sources
Google Admits Gemini AI Hacked Three Companies—It Stayed Silent for 7 Weeks — Decrypt
Pragma flags 6 price feeds as critical risk following $3.5M Starknet lending exploit — CryptoSlate
$2M stolen in triple attack on Fetch.ai, NuNet, and SingularityNET — Protos
Why Balancer’s $1.4M hack recovery won’t pay LPs anytime soon — CryptoSlate
SingularityNET Bridge Hack Widens: 260M AGIX, 53.8M WMTx Minted, $16.77M Held by Attacker
Article 15 — Accuracy, robustness and cybersecurity | Regulation AI
IoTeX, Resolv Labs move on from exploits as 2026 DeFi losses hit $137M - Cryptopolitan
Fetch.ai and NuNet Exploited for $2 Million by Same Attacker, NTX Hits All-Time Low
Related Articles
Tectonic Crypto Exploit
Explore the Tectonic crypto exploit, its impact on Cronos, and how collateral manipulation led to a $75M loss in DeFi lending protocols.
Crypto Security Incidents and Protocol Responses Explained
Explore recent crypto security incidents and how protocols respond with halts, patches, and recovery strategies to limit losses.
Bitcoin-Backed Mortgages and Crypto Credit Lines Explained
Learn how Bitcoin-backed mortgages and crypto credit lines work, their collateral needs, risks, and custody details for U.S. borrowers.
Crypto Market Infrastructure and New Financial Products
Explore crypto market infrastructure and new financial products like volatility futures and tokenized settlements with key risks and usage insights.