Three days after Splash's Cardano-based ADA/OADA StableSwap pool was drained on September 13, a code patch addressed the vulnerability—but could not solve the liquidity crisis facing OADA holders.
According to Splash's incident report, an attacker used two transactions to remove 2,434,648 ADA and 1,988,222 OADA from the pool. After accounting for the attacker's initial 9,870 ADA deposit and before network fees, the net ADA drain totaled 2,424,778.
How the Exploit Worked
The pool's validator calculated a tradable ADA reserve by subtracting accrued protocol fees from actual balances. Splash identified three critical gaps: the validator did not require the tradable reserve to remain positive, only bounded fee changes from below, and did not enforce swap direction. These oversights allowed the validator to accept a transaction after the tradable ADA reserve had turned negative.
Splash stated that either a reserve-domain check or a two-sided fee bound would have prevented the documented attack.
The Liquidity Problem Remains
The patch closes the exploit path but cannot restore what was lost. Immediately after the drain, the pool held only 10 ADA and approximately 1.44 million OADA, with a negative tradable ADA reserve. According to Splash's September 13 snapshot, OADA had no protocol-level redemption mechanism, and other OADA trading venues held only minimal ADA balances.
The attacker's OADA sale further constrained recovery options. At the time of the attack, a Minswap V2 OADA/FLDT pool contained 1,763,923 OADA against 45,751 FLDT. Splash noted that new ADA liquidity added to a reopened pool could be arbitraged against this thin inventory, allowing discounted OADA to compete for any fresh capital.
Path Forward Unclear
Splash concluded that a usable relaunch requires more than corrected code. It would need either replenished ADA liquidity or a protocol redemption mechanism, alongside management of the OADA inventory in the secondary market.
Optim Finance, which operates the protocol, paused operations on September 13 and removed remaining liquidity. In a September 15 update, the team said it was indexing the blockchain and compiling a full accounting of impacted addresses while working toward a resolution, but did not announce restored liquidity or redemption options.
