Vesu oracle incident triggers $3 million in liquidation

Vesu's lending agreement resulted in 47 positions being mistakenly cleared due to abnormal Pragma oracle data.

Vesu, a lending agreement under the Starknet ecosystem, disclosed details of an accident on September 5: due to errors in the price data provided by upstream price source Pragma, 47 positions holding US$3 million in collateral on its platform were abnormally cleared on September 4.

Incident history and scope of impact

According to the announcement issued by Vesu, the incident occurred between 04:08 and 04:10 a.m. UTC time on September 4. During this period, an upstream price source provided by Pragma delivered erroneous data, causing these erroneous prices to quickly spread to Vesu's multiple liquidity pools. The automated clearing process immediately stepped in, marking about 47 loan heads as eligible for clearing and removing about $3 million in collateral within two minutes.

Vesu pointed out that the price feed returned to normal on its own within two minutes of the accident and has been operating normally ever since. Although the agreement did not list specific data on the asset classes affected or broken down by pool in its preliminary statement, the technical report is expected to provide more detailed information on the affected markets and the sequence of transactions on the chain.

The agreement party responded: The contract has no loopholes and the execution is in accordance with the design.

Vesu emphasized that this incident was not caused by a vulnerability in the smart contract and that the contract "operates according to the established design." Because the clearing engine is automatically executed based on the price data it receives, the agreement does not require the deployment of any contract patches. Vesu blamed errors in input data rather than flaws in execution logic.

In the over-mortgage market, borrowers need to deposit assets with a value higher than the value of loans. The agreement measures the mortgage ratio through external price feeds, and when the ratio falls below the level required by the pool, a clearing mechanism is triggered. Vesu said the contract received the wrong collateral price and processed the relevant positions in accordance with the rules written in the agreement.

Industry background shows that price data is the core input in calculating the health factor of DeFi loans. Outdated or manipulated data can cause healthy positions to be mistakenly liquidated or unsafe positions to be closed. In addition, the role of blockchain oracle is not limited to the lending market. Smart contracts themselves cannot independently read off-chain market prices and must rely on external systems to collect, aggregate and publish data. Failure of the oracle in any stage of data source acquisition, aggregation or on-chain delivery may cause a functioning smart contract to complete transactions or clearing based on erroneous inputs.

Remediation measures and progress in fund recovery

After the accident, Pragma has worked with relevant organizations to deploy a remediation solution to address the root cause of the error. As a precautionary measure, mobility pool curators suspended the affected pools. Vesu said curators are expected to lift restrictions after reviewing the restoration plan. Since Vesu adopts an isolated and curator-managed loan pool model, the decision to reopen each market rests with its respective curators, and a specific recovery timetable has not yet been announced.

Vesu has coordinated with Pragma, StarkWare, Starknet Foundation and curators of the affected pools to try to recover funds obtained through liquidation. However, the agreement did not specify the specific recovery process, the proportion of the recoverable amount, or whether the liquidator agreed to return the assets. Its statement also did not promise a specific amount of compensation or payment date.

For users using Vesu Earn products, the agreement recommends maintaining a position because closing Earn positions before the recovery process is completed may disqualify users from receiving refunds. For borrowers liquidated within the incident window, Vesu requires them to submit support orders through the Discord server. Although the agreement does not specify the specific type of record to be submitted, the wallet address and transaction details are sufficient to identify the affected positions on the chain.

User Notes and Compliance Tips

For U.S. users, this incident involves decentralized finance (DeFi) products, not insured bank accounts. As the SEC Investors website states, the FDIC only insures deposits with qualified banks and does not protect securities or similar investments from declines in value. Vesu did not mention any government-backed safeguards, but instead guided users to participate in its own recycling process.

It is worth noting that blockchain transactions are usually irreversible after confirmation, so any asset recovery requires relying on asset recovery, voluntary return by liquidators, negotiated control funds, or compensation arrangements reached by other parties. Vesu has not announced which path it plans to take to recover.

In contrast, a similar oractor-related incident occurred in Aave in March 2026, and about US$26 million to US$27 million in wstETH was unexpectedly liquidated due to outdated parameters. At the time, Aave reviewed oracle update rates and alternate systems and used multiple oracle sources for major collateral types. As of now, Vesu has not announced similar changes to the oracle structure, and Pragma's root-cause fix is the only technical measure identified in the preliminary disclosure.

Vesu said it will release a full technical report after the investigation is completed. Affected borrowers can submit work orders through Discord, while Earn users are told not to close their positions to retain potential refunds eligibility.