Splash Fixes Cardano StableSwap Exploit; 2.42M ADA Still Unaccounted For

Splash said it has patched a known vulnerability in its Cardano-based ADA/OADA StableSwap pool, though 2,424,778 ADA remains missing. According to the project's incident report, a single actor executed the attack through two transactions on Sept. 13. Those transactions withdrew 2,434,648 ADA and 1,988,222 OADA. After accounting for network fees, Splash put the net ADA outflow at 2,424,778. Splash attributed the issue to how the pool validator computed the tradable reserve: it subtracted accrued protocol fees from actual balances, did not require the resulting reserve to stay positive, constrained fee changes only on the downside, and did not enforce swap direction. Splash said a reserve-domain check or a two-sided fee bound would have prevented the reconstructed attack, but neither would recover funds already removed. Immediately after the drain, the pool held 10 ADA and about 1.44 million OADA. Splash said the tradable ADA reserve was negative and the LP token balance was unchanged. A Sept. 13 snapshot cited by Splash noted OADA had no protocol-level redemption mechanism. Other OADA venues held only single- or double-digit ADA balances at the time. At 14:53 UTC on Sept. 13, a Minswap V2 OADA/FLDT pool held 1,763,923 OADA and 45,751 FLDT. Splash warned that any newly added ADA liquidity could be arbitraged against that OADA inventory, potentially leaving OADA holders without a practical exit route. The project said a relaunch would require replenished ADA liquidity or a redemption mechanism, as well as a way to address the thin-market OADA overhang. Optim Finance said on Sept. 13 that its protocol had been paused and remaining liquidity removed, adding that OADA-to-ADA swaps were unavailable. In a Sept. 15 update, Optim Finance said it was indexing the chain and compiling a full accounting of impacted addresses and assets as it worked toward a resolution. The update did not indicate that liquidity, redemption, or operations had been restored.