Vesu agreement faces a $3 million liquidation crisis due to Pragma oracle failure

Core Points

• Cause of the incident: On September 4, due to error in Pragma Oracle data, 47 user positions on the Vesu platform were mistakenly cleared.
• Contract security: Vesu confirmed that its smart contract is operating as expected and there are no security holes.
• Progress on financial recovery: Collaborative financial recovery work involving Starknet partners is in progress.

Background of the DeFi Oracle Incident

On September 4, 2026, a oracle related incident occurred in Vesu, a decentralized lending platform based on Starknet, resulting in the improper liquidation of 47 user positions, affecting approximately US$3 million in mortgage assets.

The failure occurred within an extremely short window of time-from 04:08 to 04:10 Coordinated Universal Time (UTC), and although it lasted only two minutes, it caused significant fluctuations in multiple liquidity pools in which the protocol was running. Abnormal data from upstream Pragma price sources caused this chaos. Prices returned to normal on their own within two minutes, and no further losses have been reported.

Root cause of the incident

Vesu relies on the external oracle service Pragma to obtain accurate price information to assess the health of lending positions. When Pragma transmitted erroneous pricing data, Vesu's automated clearing mechanism identified 47 positions as under-collateralized and eligible for clearing.

The automated robot immediately carried out a clearing operation and seized approximately $3 million worth of collateral before the oracle data corrected itself. The pricing anomaly lasted less than two minutes before market valuations returned to normal.

As of now, the agreement has not disclosed which assets have been mispriced, the extent of deviations from actual market prices, and the exact amount of collateral retained by the clearing robot. A comprehensive technical post-mortem analysis report is expected to be released to answer these questions.

Smart contract integrity maintained

Vesu emphasized that its underlying smart contract infrastructure "operates completely in accordance with programming logic" and there are no exploitable security weaknesses. The team said there was no need to patch the protocol level because the clearing system only responded to corrupted data from the oracle provider.

In the over-mortgage lending system, users must deposit assets that exceed the value of the loan. The agreement uses price information from external sources to continuously monitor the collateral-to-debt ratio. The automated clearing program is activated when a compromised data source incorrectly shows that the ratio is below the safety threshold.

The team pointed out that the September 4 incident originated from corruption of input data rather than a flaw in contract logic.

Fund recovery initiative launched

In response to this incident, Vesu has coordinated with Pragma, StarkWare, the Starknet Foundation and pool administrators to try to recover funds for affected parties.

The agreement has not disclosed how much of the $3 million is likely to be recovered, nor has it disclosed whether the clearing robot operator has committed to returning seized assets. The specific compensation amount or repayment schedule has not been disclosed.

Users who went through liquidation within the critical two minutes were instructed to submit support requests through Vesu's Discord channel. Users who use Earn products are warned not to close their positions too early, as it could jeopardize their eligibility for potential compensation.

Industry background to the DeFi oracle incident

Such oracle failures are not isolated in the decentralized finance space. In March 2026, Aave encountered a similar situation, when $26 million to $27 million in wstETH was mistakenly liquidated due to outdated parameters. Since then, Aave has reviewed its oracle refresh interval and standby mechanisms.

Beyond the fixes implemented by Pragma, Vesu has not disclosed any changes to its oracle infrastructure or risk management agreements.

Blockchain-based smart contracts themselves do not have the ability to independently access external markets for pricing, and rely entirely on the oracle network to collect, integrate and transmit price information to on-chain systems. An interruption in any link in the data pipeline can lead to wrong trading or clearing behavior.

The agreement stated that a detailed technical analysis report will be released after the investigation is completed.