Cardano’s Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped

Three days after Splash’s Cardano-based ADA/OADA StableSwap pool was drained, OADA holders still faced a problem that corrected code alone could not solve: the pool had lost the ADA that provided their meaningful route out of the token.

Splash’s incident report said one actor used two transactions on Sept. 13 to remove 2,434,648 ADA and 1,988,222 OADA. After subtracting the attacker’s 9,870 ADA deposit, but before network fees, the ADA drain was 2,424,778.

Why a code patch is not a liquidity fix

The pool’s validator calculated a “tradable” reserve by subtracting accrued protocol fees from its real balances. According to Splash, it did not require that reserve to remain positive, bounded fee changes only from below and did not enforce the direction of a swap.

Those missing checks allowed the validator to accept a transaction after the tradable ADA reserve had turned negative. Splash said a reserve-domain check or a two-sided fee bound would have stopped the reconstructed attack.

Either fix would close the documented exploit path. Neither would return the ADA that had already left the pool. Immediately after the drain, the pool held 10 ADA and about 1.44 million OADA, while its tradable ADA reserve was negative and its LP token balance was unchanged.

The balance-sheet damage matters because Splash’s Sept. 13 snapshot said OADA had no protocol-level redemption. Other OADA venues in the report were close to empty at that time, with the listed pools holding only single- or double-digit ADA balances.

The attacker’s OADA sale created another constraint. At 14:53 UTC on Sept. 13, a Minswap V2 OADA/FLDT pool held 1,763,923 OADA against 45,751 FLDT. Splash said new ADA/OADA liquidity could be arbitraged against that inventory, allowing discounted OADA to compete for any fresh ADA placed in a reopened pool.

A code patch can stop the documented exploit path, but restoring an OADA exit also requires ADA liquidity or redemption and management of the thin-pool OADA inventory.

A usable relaunch would therefore require more than corrected validator logic. It would need replenished ADA liquidity or a protocol redemption mechanism, along with a way to address the OADA inventory in the thin secondary market.

Optim Finance said on Sept. 13 that its protocol was paused, remaining liquidity had been removed and OADA-to-ADA swaps were unavailable. In a Sept. 15 update, it said it was indexing the chain and compiling a full accounting of impacted addresses and assets while working toward a resolution. That update did not announce restored liquidity, redemption or operations.