CryptoSlate
Splash's incident report said one actor used two transactions on Sept. 13 to remove 2,434,648 ADA and 1,988,222 OADA from its Cardano-based ADA/OADA StableSwap pool. After subtracting the attacker's 9,870 ADA deposit, the net ADA drain was 2,424,778 before network fees. Three days later, corrected validator code had closed the documented exploit path, but OADA holders still lacked a meaningful route out.
Why it matters
The flaw came from how the pool calculated its tradable reserve. The validator subtracted accrued protocol fees from real balances but did not require the reserve to remain positive, impose an upper and lower bound on fee changes, or enforce swap direction. Splash said a reserve-domain check or a two-sided fee bound would have blocked the reconstructed attack.
Those controls can prevent another drain, but they cannot restore the ADA already removed. Immediately afterward, the pool held only 10 ADA and about 1.44 million OADA, while its tradable ADA reserve was negative and its LP token balance was unchanged. Splash's Sept. 13 snapshot also said OADA had no protocol-level redemption. Other OADA venues were nearly empty, with listed pools holding only single- or double-digit ADA balances.
Market impact
A relaunch faces a second problem beyond validator security. At 14:53 UTC on Sept. 13, a Minswap V2 OADA/FLDT pool held 1,763,923 OADA against 45,751 FLDT. Splash said that inventory could be arbitraged against new ADA/OADA liquidity, allowing discounted OADA to compete for fresh ADA placed in a reopened pool.
A usable recovery therefore requires replenished ADA liquidity or a redemption mechanism, plus a plan for the thin secondary-market OADA inventory. Optim Finance said its protocol was paused, remaining liquidity had been removed and OADA-to-ADA swaps were unavailable. Its Sept. 15 update said it was accounting for impacted addresses and assets while working toward a resolution, but did not announce restored liquidity, redemption or operations.
Frequently asked questions
-
How much ADA did the Splash exploit remove?
The attack removed 2,434,648 ADA. After subtracting the attacker's 9,870 ADA deposit, the net ADA drain was 2,424,778 before network fees.
-
What did Splash's patch fix?
The patch closed the documented validator exploit path. Splash identified reserve-domain checks and two-sided fee bounds as controls that would have blocked the reconstructed attack.
-
Why are OADA holders still unable to exit?
The pool lost the ADA that provided its meaningful route out, and Splash's snapshot said OADA had no protocol-level redemption. The remaining pool held only 10 ADA and about 1.44 million OADA.
-
What could complicate reopening the ADA/OADA pool?
Thin secondary-market OADA inventory could be arbitraged against fresh ADA liquidity. A Minswap V2 OADA/FLDT pool held 1,763,923 OADA against 45,751 FLDT on Sept. 13.
-
What recovery steps did Optim Finance announce?
Optim Finance said the protocol was paused, remaining liquidity had been removed and OADA-to-ADA swaps were unavailable. Its Sept. 15 update described accounting and resolution work but did not announce restored liquidity or operations.
CoinDesk
WuBlockchain
Lookonchain