Cardano's Splash patches exploit, but 2,424,778 ADA remains missing

Splash patched the documented exploit in its Cardano-based ADA/OADA StableSwap pool, but 2,424,778 ADA remained missing. Splash's incident report said one actor used two transactions. The transactions occurred on Sept. 13. The transactions removed 2,434,648 ADA. They also removed 1,988,222 OADA. The net ADA drain was 2,424,778 before network fees. Splash said the pool validator calculated a tradable reserve by subtracting accrued protocol fees from real balances. The validator did not require the reserve to remain positive. It bounded fee changes only from below. It also did not enforce swap direction. Splash said a reserve-domain check or a two-sided fee bound would have stopped the reconstructed attack. The checks would not restore ADA that had already left the pool. The pool held 10 ADA immediately after the drain. It held about 1.44 million OADA at that time. Its tradable ADA reserve was negative. Its LP token balance was unchanged. Splash's Sept. 13 snapshot said OADA had no protocol-level redemption. Other OADA venues held only single- or double-digit ADA balances at that time. At 14:53 UTC on Sept. 13, a Minswap V2 OADA/FLDT pool held 1,763,923 OADA. The pool held 45,751 FLDT. Splash said fresh ADA liquidity could be arbitraged against that OADA inventory. This could leave OADA holders without a meaningful route out of the token. A relaunch would require replenished ADA liquidity or a protocol redemption mechanism. It would also require a way to address the thin-market OADA inventory. Optim Finance said on Sept. 13 that its protocol was paused. It said remaining liquidity had been removed. It said OADA-to-ADA swaps were unavailable. In a Sept. 15 update, Optim Finance said it was indexing the chain. It was also compiling a full accounting of impacted addresses and assets. It was working toward a resolution. The update did not announce restored liquidity, redemption, or operations.