SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Nostra Finance Loses $3.5M After Attacker Manipulates NSTR Oracle 8,000x on Starknet

0
·12 views

Starknet lending protocol Nostra Finance suffered a $3.5 million exploit on September 17, 2026, when an attacker manipulated the price of NSTR tokens from roughly $0.006 to $49.5 within minutes. The attacker created a fake NSTR/SolvBTC liquidity pool and used wash trades to inflate the price, then posted the overvalued NSTR as collateral to borrow ETH, STRK, USDC, USDT, WBTC, and DAI. Security firms including GoPlus Security, PeckShield, CertiK, and SlowMist classified the incident as oracle price manipulation rather than a smart contract vulnerability. Nostra responded by halting all protocol functions, causing total value locked to plummet from approximately $4 million to $710,000, freezing funds for all users including those uninvolved in borrowing. Investigators noted the attacker had been accumulating NSTR positions since March 2026 and exploited weaknesses in how price aggregators select reference pools, pointing to a broader supply-chain risk for DeFi lending protocols.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

RAG Pipelines Face 'Knowledge Injection' Attacks That Hijack LLM Responses

Retrieval-Augmented Generation (RAG), widely used to ground large language models in private or real-time data, contains a critical vulnerability in its core architecture. Attackers can plant malicious instructions inside documents, web pages, or tool outputs that the RAG pipeline retrieves, causing the LLM to treat adversarial content as authoritative. This technique, called knowledge injection or indirect prompt injection, differs from direct prompt injection because the attacker targets the data source rather than the user's query. A detailed engineering analysis published on DEV Community outlines why standard RAG implementations are inherently fragile due to implicit trust in retrieved content. The article proposes a layered defense strategy covering source isolation, semantic threat detection, and dual-model orchestration to harden RAG systems against such attacks.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CISA Flags Two SonicWall SMA 1000 Flaws as Actively Exploited, Gives Agencies 3 Days to Patch

CISA added two SonicWall SMA 1000 vulnerabilities — a pre-authentication SSRF flaw (CVE-2026-83548) and an OS command injection flaw (CVE-2026-83549) — to its Known Exploited Vulnerabilities catalog on September 2, 2026, with a federal remediation deadline of September 5. SonicWall responded the same day by publishing advisory SNWLID-2026-0016 alongside patched firmware versions 12.4.3-03526 and 12.5.0-02952. A ZoomEye scan conducted on September 18, 2026, identified only 7 records matching the precise SMA product fingerprint, reflecting that the appliance's management interface is not intended for public exposure. Security researchers caution that broader vendor-name searches returning millions of SonicWall-branded assets do not accurately represent SMA 1000 exposure and should not be conflated with the specific vulnerability surface. Organizations are advised to query their own perimeters using the product-specific fingerprint and treat any internet-reachable SMA 1000 portal as potentially vulnerable until patched versions are confirmed.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Three MCP Servers That Extend Claude Desktop With Files, GitHub, and Postgres

A developer has shared three Model Context Protocol (MCP) servers they actively use with Claude Desktop to enhance productivity. The filesystem server allows Claude to directly read project files, eliminating the need to manually copy-paste code into the chat. The GitHub server enables Claude to browse repositories, review pull requests, and summarize recent code changes. A PostgreSQL server grants Claude direct database query access without leaving the conversation. Each server can be installed via the mcp-hub CLI in roughly two minutes, though users are cautioned to restrict filesystem paths carefully to avoid unintended disk-wide access.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Console Snake and Ladder Game in Go to Teach Clean Code Design

A developer published a console-based Snake and Ladder game written in Go, sharing it as a practical example of clean software design principles. The project features a 100-square board with snakes, ladders, and three player tokens that take turns rolling a six-sided die. Each component — Board, Dice, Coin, Snake, and Ladder — is built as a separate type with a single responsibility, following common object-oriented design patterns. Snakes and ladders share a common interface called Jumps, allowing the game logic to handle both without distinguishing between them. The project is intended to help developers understand concepts such as facades, polymorphism, and interface-based design in Go.

0 comments Read more at DEV Community