{"investigation":{"slug":"omm","entity_name":"Omm","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Omm (Open Money Market) is a decentralized lending and borrowing protocol built on the ICON blockchain, launched in August 2021 by Lydia Labs (formerly ICX Station), co-founded by Scott Smiley and Daeki Lee. On January 21, 2023, the protocol suffered a smart contract exploit in which an attacker deployed a malicious contract to drain approximately $1.9 million in user collateral across 18 transactions, exploiting a critical flaw in the Redeem function. Following the exploit, the protocol pivoted away from its money market model toward a liquid staking product, which launched in January 2024, though TVL and market activity remain minimal.","sections":[{"content":"Omm, short for Open Money Market, is a DeFi lending and borrowing protocol deployed on the ICON blockchain. It was developed by Lydia Labs (formerly known as ICX Station), whose co-founders Scott Smiley and Daeki Lee are also members of the ICON Foundation. The protocol launched on August 24, 2021, and within 48 hours reported over $50 million in total value locked (TVL). Omm allowed users to supply digital assets to earn interest, borrow against collateral, and earn OMM governance tokens as rewards. The OMM token confers voting rights in the protocol's DAO governance. The protocol is distinct as one of the few DeFi projects built natively on the ICON blockchain rather than Ethereum or Solana. Scott Smiley also co-founded Balanced Network, ICON's primary DEX.","heading":"Protocol Overview","sources":[{"url":"https://www.globenewswire.com/en/news-release/2021/08/24/2285343/0/en/Omm-Launches-Decentralised-Money-Markets-on-ICON-Blockchain.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://theicon.ist/2021/08/27/welcome-omm-icons-decentralized-open-money-market/","name":"theicon.ist","type":"other","credibility":3},{"url":"https://ommfinance.medium.com/omm-a-new-defi-project-for-icon-c840abd4befe","name":"ommfinance.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 21, 2023 at 07:06:37 UTC, an unknown attacker exploited a critical vulnerability in Omm's smart contract, resulting in approximately $1.9 million in user funds being drained. The attacker deployed a malicious contract and executed 18 separate transactions to steal IUSDC, USDS, bnUSD, and sICX collateral belonging to other users. The root vulnerability was located in Omm's Redeem function, which accepted an arbitrary address parameter for the collateral being returned. This design flaw allowed the attacker to inject their malicious contract, bypassing normal supply and authorization procedures and enabling theft of collateral that was not theirs. After stealing the collateral, the attacker supplied the stolen USDS as their own collateral and took out sICX loans. The attacker subsequently swapped large quantities of stolen assets through Balanced Network (ICON's DEX), which caused the bnUSD stablecoin and other assets to temporarily de-peg from their $1 values. The attacker also bridged IUSDC to Ethereum and Polygon via the Orbit Bridge, and cashed out ICX tokens to centralized exchanges. The Omm team published a postmortem on January 23, 2023, confirming the exploit and stating they were in contact with exchanges in an attempt to freeze or recover funds. No significant recovery of stolen funds has been publicly confirmed. This exploit is recorded in DeFiLlama's hacks database with a confirmed loss of $1.89 million.","heading":"January 2023 Smart Contract Exploit","sources":[{"url":"https://forum.omm.finance/t/omm-exploit-postmortem-january-2023/266","name":"forum.omm.finance","type":"other","credibility":3},{"url":"https://defillama.com/protocol/omm","name":"defillama.com","type":"other","credibility":3},{"url":"https://medium.com/rektify-ai/learning-from-the-biggest-defi-hacks-of-2023-1cab753ac4ea","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Omm exploit is categorized as a protocol logic flaw. The Redeem function in Omm's smart contracts, written in Java for the ICON blockchain virtual machine, accepted a caller-supplied address parameter identifying the collateral to be returned. Crucially, the contract failed to validate that the caller was the legitimate owner of the referenced collateral. An attacker could inject an address pointing to a malicious contract they controlled, which would then execute during the redemption callback, bypassing the normal collateral supply check. This class of vulnerability — where a function accepts an external address without validating ownership or trust — is a well-documented attack vector in DeFi smart contracts. The attack unfolded across 18 transactions, suggesting the attacker systematically targeted multiple asset pools. No third-party pre-exploit audit report for Omm's smart contracts has been surfaced in publicly available sources.","heading":"Technical Vulnerability Analysis","sources":[{"url":"https://forum.omm.finance/t/omm-exploit-postmortem-january-2023/266","name":"forum.omm.finance","type":"other","credibility":3},{"url":"https://medium.com/rektify-ai/learning-from-the-biggest-defi-hacks-of-2023-1cab753ac4ea","name":"medium.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/omm","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the January 2023 exploit, the Omm community engaged in governance discussions about the protocol's future. The lending and borrowing market product was not relaunched after the hack. In 2023, OMM token holders approved a governance proposal to pivot the protocol away from the money market model toward a liquid staking product for ICX, ICON's native token. The new product, which allows users to convert ICX to sICX (staked ICX) and earn staking rewards while retaining liquidity, launched in January 2024. As of 2025, TVL in the Omm protocol stood at approximately $150,000, a fraction of its peak. The pivot represents a significant reduction in scope compared to the original multi-asset lending platform. The DAO Fund and bOMM (Boosted OMM) governance token continue to operate, allowing token holders to vote on fees and protocol parameters.","heading":"Post-Exploit Response and Pivot to Liquid Staking","sources":[{"url":"https://docs.omm.finance/liquid-staking-pivot","name":"docs.omm.finance","type":"other","credibility":3},{"url":"https://omm.finance/","name":"omm.finance","type":"other","credibility":3},{"url":"https://defillama.com/protocol/omm","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The OMM token was launched August 26, 2021 as a fair-launch governance and reward token for the Omm protocol. Initial distribution was 1,000,000 OMM per day for the first 30 days, then 400,000 per day for the remainder of the first year, with annual reductions of 100,000 per year until a 3% inflation rate was reached. The token is listed on CoinMarketCap and CoinGecko but trades with negligible volume. Current circulating supply data is not verifiable from public sources as of May 2026. The OMM token's contract address on ICON is cx1a29259a59f463a67bb2ef84398b30ca56b5830a. The token was significantly affected by both the 2022 bear market and the January 2023 exploit, and has not recovered to pre-exploit valuations. The protocol's current TVL of approximately $150,000 indicates minimal user activity.","heading":"Token and Market Data","sources":[{"url":"https://coinmarketcap.com/currencies/omm-finance/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://theicon.ist/2021/08/27/welcome-omm-icons-decentralized-open-money-market/","name":"theicon.ist","type":"other","credibility":3},{"url":"https://defillama.com/protocol/omm","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Omm was built and launched by Lydia Labs, formerly known as ICX Station. The co-founders are Scott Smiley and Daeki Lee, both of whom are members of the ICON Foundation. Scott Smiley has been a prominent figure in the ICON ecosystem since approximately April 2018 and also co-founded Balanced Network, ICON's major DEX. Lydia Labs is responsible for several key DeFi protocols in the ICON ecosystem, including both Balanced and Omm. The team's membership on the ICON Foundation creates a degree of organizational overlap between the developer team and the underlying blockchain's governance body. No evidence of regulatory action, criminal charges, or exit by the founding team has been identified in public sources.","heading":"Team and Organizational Background","sources":[{"url":"https://myiconcommunity.com/p-rep-interviews/balanced-network-founder-how-to-build-biggest-dex-on-icon-network-best-multi-chain-scott-smiley/","name":"myiconcommunity.com","type":"other","credibility":3},{"url":"https://theicon.ist/the-icon-team/","name":"theicon.ist","type":"other","credibility":3}],"severity":"medium"},{"content":"Omm carries several risk factors. First, the protocol suffered a confirmed $1.9 million smart contract exploit in January 2023 due to a critical logic flaw in its Redeem function; no significant fund recovery has been confirmed. Second, stolen funds were moved through cross-chain bridges (Orbit Bridge) and centralized exchanges, complicating tracing and recovery. Third, the protocol pivoted its entire product after the hack, abandoning the original lending market, which represents a significant change to the risk surface but also indicates the prior product was not rebuilt with security fixes. Fourth, the protocol operates on the ICON blockchain, an ecosystem with limited liquidity and external security researcher coverage compared to Ethereum-based protocols. Fifth, current TVL is negligible (approximately $150,000), meaning the protocol has limited economic activity and depth. Sixth, ZachXBT has flagged this entity, though the specific nature or publication of that flagging is not independently verified from primary sources in this investigation. Users of the current liquid staking product face smart contract risk on a protocol with a prior exploit history.","heading":"Risk Assessment","sources":[{"url":"https://defillama.com/protocol/omm","name":"defillama.com","type":"other","credibility":3},{"url":"https://forum.omm.finance/t/omm-exploit-postmortem-january-2023/266","name":"forum.omm.finance","type":"other","credibility":3},{"url":"https://twitter.com/ommfinance","name":"twitter.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-08-24","event":"Omm officially launches on the ICON blockchain, announced via GlobeNewswire.","source":""},{"date":"2021-08-26","event":"First OMM tokens minted; protocol reports over $50 million TVL within 48 hours of launch.","source":""},{"date":"2022","event":"Omm publishes January 2022 roadmap update; protocol is active with lending and borrowing markets operational.","source":"","date_original":"2022-01-01"},{"date":"2023-01-21","event":"Smart contract exploit: attacker deploys malicious contract and drains approximately $1.9 million in IUSDC, USDS, bnUSD, and sICX collateral across 18 transactions via a vulnerability in the Redeem function.","source":""},{"date":"2023-01-23","event":"Omm team publishes official postmortem on community forum; lending markets not relaunched. Team states they are contacting exchanges to attempt fund recovery.","source":""},{"date":"2023","event":"Community governance discussions begin regarding pivot away from money market to liquid staking product.","source":"","date_original":"2023-01-01"},{"date":"2024","event":"Liquid staking product for ICX (sICX) launches on Omm following community governance approval, replacing the prior lending market.","source":"","date_original":"2024-01-01"}],"sources_used":[{"url":"https://forum.omm.finance/t/omm-exploit-postmortem-january-2023/266","name":"Omm exploit postmortem | January 2023 - Omm Forum","type":"official","archive_url":"http://web.archive.org/web/20251203212809/https://forum.omm.finance/t/omm-exploit-postmortem-january-2023/266","credibility":2,"archive_timestamp":"2025-12-03T21:28:09+00:00"},{"url":"https://defillama.com/protocol/omm","name":"DeFiLlama - Omm Protocol Page","type":"research","archive_url":"http://web.archive.org/web/20250907050132/https://defillama.com/protocol/omm","credibility":2,"archive_timestamp":"2025-09-07T05:01:32+00:00"},{"url":"https://medium.com/rektify-ai/learning-from-the-biggest-defi-hacks-of-2023-1cab753ac4ea","name":"Learning from the Biggest DeFi Hacks of 2023 - Rektify AI (Medium)","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.globenewswire.com/en/news-release/2021/08/24/2285343/0/en/Omm-Launches-Decentralised-Money-Markets-on-ICON-Blockchain.html","name":"Omm Launches Decentralised Money Markets on ICON Blockchain - GlobeNewswire","type":"news_article","archive_url":"https://web.archive.org/web/20260724173614/https://www.globenewswire.com/en/news-release/2021/08/24/2285343/0/en/Omm-Launches-Decentralised-Money-Markets-on-ICON-Blockchain.html","credibility":2,"archive_timestamp":"2026-07-24T17:36:14+00:00"},{"url":"https://theicon.ist/2021/08/27/welcome-omm-icons-decentralized-open-money-market/","name":"Welcome Omm, ICON's Decentralized Open Money Market - The Iconist","type":"news_article","archive_url":"https://web.archive.org/web/20260724211150/https://theicon.ist/2021/08/27/welcome-omm-icons-decentralized-open-money-market/","credibility":2,"archive_timestamp":"2026-07-24T21:11:50+00:00"},{"url":"https://ommfinance.medium.com/omm-a-new-defi-project-for-icon-c840abd4befe","name":"Omm: a new DeFi project for ICON - Medium","type":"official","archive_url":"https://web.archive.org/web/20260725123643/https://ommfinance.medium.com/omm-a-new-defi-project-for-icon-c840abd4befe","credibility":2,"archive_timestamp":"2026-07-25T12:36:43+00:00"},{"url":"https://docs.omm.finance/liquid-staking-pivot","name":"Omm Liquid Staking Pivot Documentation","type":"official","archive_url":"http://web.archive.org/web/20251206220200/https://docs.omm.finance/liquid-staking-pivot","credibility":2,"archive_timestamp":"2025-12-06T22:02:00+00:00"},{"url":"https://omm.finance/","name":"Omm Finance Official Website","type":"official","archive_url":"http://web.archive.org/web/20251215090037/https://omm.finance/","credibility":2,"archive_timestamp":"2025-12-15T09:00:37+00:00"},{"url":"https://coinmarketcap.com/currencies/omm-finance/","name":"CoinMarketCap - Omm Tokens (OMM)","type":"other","archive_url":"https://web.archive.org/web/20260724210154/https://coinmarketcap.com/currencies/omm-finance/","credibility":2,"archive_timestamp":"2026-07-24T21:01:54+00:00"},{"url":"https://myiconcommunity.com/p-rep-interviews/balanced-network-founder-how-to-build-biggest-dex-on-icon-network-best-multi-chain-scott-smiley/","name":"Balanced Network Founder Interview - ICON Community (Scott Smiley)","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://theicon.ist/the-icon-team/","name":"The ICON Team - The Iconist","type":"other","archive_url":"http://web.archive.org/web/20260103015432/https://theicon.ist/the-icon-team/","credibility":2,"archive_timestamp":"2026-01-03T01:54:32+00:00"},{"url":"https://defillama.com/hacks","name":"DeFi Hacks & Exploits Database - DefiLlama","type":"research","archive_url":"http://web.archive.org/web/20260714032429/https://defillama.com/hacks","credibility":2,"archive_timestamp":"2026-07-14T03:24:29+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:44.99217+00:00","updated_at":"2026-08-29T01:34:39.194+00:00"}}