Oracle Error: illegal variable name/number in ASP.Net

kindly assist me here, i am getting an error "illegal variable name/number" the error is point to:

command2.ExecuteNonQuery();

                        if (status == "Y")
                        {
                            string constr2 = ConfigurationManager.ConnectionStrings["constr"].ConnectionString;
                            using (OracleConnection connection2 = new OracleConnection(constr2))
                            {
                                if (connection2.State != ConnectionState.Open)
                                {
                                    connection2.Open();
                                }
                                OracleCommand command2 = connection.CreateCommand();

                            //update query

                            var InstStatus = "LIQD";
                            var CONTRACT_REF_NO = row["CONTRACT_REF_NO"].ToString();

                            command2.CommandType = CommandType.Text;
                            command2.CommandText = "update ISTM_INSTR_TXN set INSTR_STAT = :param1 where contract_ref= keyValue";
                            command2.Parameters.AddWithValue("param1", InstStatus);
                            command2.Parameters.AddWithValue("keyValue", CONTRACT_REF_NO);
                            command2.ExecuteNonQuery();

Thanks