Splash patch blocks exploit; 2.42M ADA drained

On Sept. 13 an attacker removed a net 2,424,778 ADA from Splash’s Cardano ADA/OADA StableSwap pool, according to Splash’s incident report. The report shows the actor executed two transactions that withdrew 2,434,648 ADA and 1,988,222 OADA, and included a 9,870 ADA deposit; after network fees the net ADA taken was 2,424,778.

The exploit stemmed from validator logic used to check the pool’s tradable reserve. The pool computed tradable ADA by subtracting accrued protocol fees from real balance holdings but did not require that value to stay positive. Validator checks also bounded fee changes only from below and did not enforce swap direction. Those missing checks allowed transactions to be accepted after the pool’s tradable ADA reserve had gone negative.

Splash deployed a corrected validator to close the documented exploit path. The fix changes the reserve and fee checks in the validator logic. The update does not restore ADA that had already been withdrawn.

After the drain the pool held about 10 ADA and roughly 1.44 million OADA, while its tradable ADA reserve showed a negative value and LP token balances were unchanged. Splash’s Sept. 13 snapshot noted that OADA had no protocol-level redemption mechanism and that other venues holding OADA showed only single- or double-digit ADA balances at the time.

Secondary market inventories were thin on Sept. 13. At 14:53 UTC a Minswap V2 OADA/FLDT pool contained 1,763,923 OADA against 45,751 FLDT. Splash’s report warned that thin OADA inventories on secondary venues could be used to arbitrage any fresh ADA liquidity added to a reopened pool.

Optim Finance paused protocol operations on Sept. 13, removed remaining liquidity and suspended OADA-to-ADA swaps. In a Sept. 15 update the protocol reported it was indexing the chain and compiling a full accounting of impacted addresses and assets. The update did not announce restored ADA liquidity, a redemption mechanism or a timeline to resume swaps.

The corrected validator addresses the specific technical checks that enabled the attack; the withdrawn ADA remains unrecovered and OADA currently lacks a protocol-level exit path.