Vesu Lending Protocol Loses $3M in Oracle-Driven Liquidation Flash

Vesu officials maintain that the protocol’s smart contracts performed exactly as programmed, characterizing the event as an issue of bad data ingestion rather than a security breach. Because the system relies on external price feeds to determine the health of collateralized loans, the incorrect data made 47 borrowing positions appear under-collateralized. Automated liquidators processed these positions instantly, executing the removals before the feed returned to normal market values.

While the protocol has avoided a direct technical patch—arguing that the engine functioned according to its rules—it is now working alongside Pragma, the Starknet Foundation, and StarkWare to navigate the fallout. Recovery remains complex, as blockchain transactions are traditionally final. The protocol has not yet detailed how it intends to claw back the assets or whether liquidators, who captured the collateral, are willing to return the funds.

Users impacted by the incident have been instructed to file support tickets via Vesu’s Discord server, while those holding assets in the protocol’s Earn product are advised to keep their positions open to maintain eligibility for potential future reimbursements. Curators overseeing the affected liquidity pools suspended activity as a precautionary measure, awaiting a final technical report and a comprehensive review of the fix deployed by Pragma.