|0°C
Next edition scheduled
Your Personal Daily Intelligence
Edition 2026-09-18

CRYPTO

Cardano's Splash fix addresses exploit but leaves 2.4 million ADA inaccessible

Three days after the Splash stable‑swap pool on Cardano was drained, holders of the OADA token continued to confront a problem that a code patch alone could not resolve: the poo...

By cryptoslate · 35d ago · Source: cryptoslate

Full article

Three days after the Splash stable‑swap pool on Cardano was drained, holders of the OADA token continued to confront a problem that a code patch alone could not resolve: the pool had lost the ADA that served as their primary exit route. According to Splash’s incident report, an attacker executed two transactions on September 13 to withdraw 2,434,648 ADA and 1,988,222 OADA. After accounting for the attacker’s 9,870 ADA deposit but before network fees, the ADA drain amounted to 2,424,778. The validator calculated a tradable reserve by subtracting accrued protocol fees from the pool’s actual balances. The report noted that the reserve need not stay positive, that fee changes could occur only from below, and that the system did not enforce the direction of a swap. Those missing checks permitted the validator to accept a transaction after the tradable ADA reserve turned negative. Splash indicated that a reserve‑domain check or a two‑sided fee bound would have blocked the reconstructed attack, though neither remedy would return the ADA already removed from the pool. Immediately after the drain, the pool held 10 ADA and roughly 1.44 million OADA, while its tradable ADA reserve was negative and its LP token balance remained unchanged. The balance‑sheet impact matters because Splash’s September 13 snapshot indicated that OADA lacked protocol‑level redemption. Other OADA venues listed in the report were nearly empty, with balances limited to single‑ or double‑digit ADA amounts. The attacker’s OADA sale introduced another constraint. At 14:53 UTC on September 13, a Minswap V2 OADA/FLDT pool contained 1,763,923 OADA against 45,751 FLDT. Splash suggested that new ADA/OADA liquidity could be arbitraged against that inventory, allowing discounted OADA to compete for any fresh ADA placed in a reopened pool. A code patch can block the documented exploit path, but restoring an OADA exit also requires ADA liquidity or a redemption mechanism and management of the thin‑pool OADA inventory. Consequently, a functional relaunch would need replenished ADA liquidity or a protocol redemption feature, along with a strategy for handling the thin secondary market OADA inventory. Optim Finance announced on September 13 that its protocol was paused, remaining liquidity had been removed, and OADA‑to‑ADA swaps were unavailable. A subsequent update on September 15 said the team was indexing the chain and compiling a full accounting of affected addresses and assets while pursuing a resolution, but it did not announce restored liquidity, redemption or operational status.

Source transparency

Publisher
cryptoslate
Reliability
high
Published
9/18/2026, 7:22:00 AM
Retrieved
9/18/2026, 7:22:00 AM
Relevance
80%
Confidence
85%
Read original at cryptoslate

Botwin's Morning Wire publishes the full source article for reading convenience. Please visit the publisher for the original presentation and any updates.