Splash Exploit Drains Cardano ADA/OADA Pool

Splash Protocol has released a technical report explaining how an attacker drained the ADA/OADA StableSwap pool on September 13.

Optim Finance subsequently paused its protocol, removed the remaining liquidity under its control and warned users that OADA could no longer be swapped back into ADA through its normal route.

Splash said no other pool types were affected. The incident occurred within application-level smart contract infrastructure and did not compromise the Cardano network itself.

How the StableSwap Validator Was Exploited

The vulnerability was located in Splash’s stableFnPoolT2t validator, which powered the two-asset ADA/OADA StableSwap pool.

The validator calculated tradable reserves by subtracting accumulated protocol fees from the pool’s total balance. However, it did not verify that the resulting reserves remained positive. It also lacked a sufficient upper limit on increases in protocol fees and did not enforce the expected swap direction, where one asset enters the pool while another leaves.

The attacker exploited those missing controls across two transactions.

In the first transaction, executed at 00:47:36 UTC, the attacker deposited 9,870 ADA and a minimal amount of OADA. Almost the entire ADA deposit was recorded as protocol fees, leaving only one lovelace added to the pool’s tradable ADA reserve.

Forty-five seconds later, a second transaction pushed the calculated tradable ADA reserve below zero. Because the StableSwap invariant was evaluated using a negative reserve, the validator accepted a transaction that removed both ADA and OADA from the pool.

The LP token supply remained unchanged, with no LP tokens minted or burned during the exploit.

Splash said either of two additional protections would have stopped the attack: requiring tradable reserves to remain positive or enforcing an upper limit on changes to accumulated protocol fees.

The report also states that the executed swap branch matched the previously audited code. The 2024 audit did not identify the missing protocol fee, positive reserve and swap direction checks used in the attack.

Why the Pool Was Critical to OADA

OADA is an ADA-pegged synthetic asset developed by Optim Finance. Users can mint OADA by depositing ADA, but the system does not provide a direct mechanism for redeeming OADA back into ADA.

Instead, users normally exit through the ADA/OADA StableSwap pool on Splash. The pool also supported Optim’s Algorithmic Market Operation, which managed liquidity to keep OADA close to its ADA peg.

The official incident report attributes the exploit to the Splash validator. It does not identify a vulnerability in Optim’s AMO or describe the incident as an Optim contract hack.

Draining the Splash pool removed OADA’s primary exit route and the market used to support its peg.

The attacker then sold the removed OADA through a Minswap V2 OADA/FLDT pool. The swap produced approximately 563,073 FLDT, which was later converted into approximately 115,323 ADA.

Optim reported that the attacker also emptied OADA liquidity from other trading venues. Those protocols were not compromised through the same validator flaw. Their markets were affected after the main Splash pool had already been drained.

What Happens Next

Optim said its protocol was paused and all available liquidity had been removed. It instructed anyone providing liquidity for OADA or the Optim governance token O to withdraw immediately and warned users not to create new OADA liquidity positions.

Optim has not clarified whether the pause covers every product and module or only operations connected to OADA.

Splash has marked the affected StableSwap code as vulnerable and is tracing funds sent to addresses connected with exchange deposit systems. The team said it plans to contact KuCoin and Gate.io with transaction information.

Splash also invited the attacker to return the funds through a potential white-hat resolution involving a reward and no further escalation.

No funds have been publicly confirmed as returned. Neither Splash nor Optim has announced a reimbursement program, recovery timeline or fixed validator release.