Verify a decision

{"actor":"system:backfill","investigation_id":"d5038ea6-f6da-4298-a96e-65d8691cf8e0","kind":"publish","page_slug":"splash-optim-finance-oada-cardano-stableswap-exploit","published_at":"2026-09-19T12:05:25.477Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Splash / Optim Finance (OADA) Cardano StableSwap Exploit","sections":[{"content":"On September 13, 2026, a single actor executed two on-chain transactions against Splash Protocol's ADA/OADA StableSwap pool on the Cardano blockchain, draining 2,434,648 ADA and 1,988,222 OADA. After subtracting the attacker's own 9,870 ADA deposit — used to initiate the exploit — the net ADA loss attributable to the attack is approximately 2,424,778 ADA. The pool, which had previously held significant ADA/OADA liquidity supporting OADA's peg mechanism, was left with only 10 ADA and approximately 1.44 million OADA after the drain. No attacker wallet addresses or transaction hashes had been publicly disclosed by the protocols as of the latest available reporting. Both Splash and Optim Finance were victims of the exploit; neither protocol perpetrated the attack.","heading":"The Exploit","severity":"critical","sources":[{"credibility":2,"name":"Cardano's Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"},{"credibility":2,"name":"Optim Finance Pauses OADA After Splash Pool Exploit Drains Cardano Liquidity — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity/"},{"credibility":2,"name":"Cardano's Splash Fix Patches Exploit, Leaves 2.4M ADA Missing — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/cardano-s-splash-fix-patches-exploit-leaves-2-4m-ada-missing"}]},{"content":"According to Splash's own post-incident disclosure, the pool's StableSwap validator contained three critical missing checks that collectively enabled the exploit. First, the validator calculated a 'tradable' reserve by subtracting accrued protocol fees from the pool's real token balances, but did not require that tradable reserve to remain non-negative. Second, the validator bounded fee changes only from below — it imposed a floor but not a ceiling, leaving the upper bound unenforced. Third, the validator did not enforce the direction of a swap. Together, these omissions allowed the attacker to submit a transaction that the validator accepted even after the tradable ADA reserve had turned negative, enabling extraction of real tokens against a constructed negative-reserve state. CryptoSlate reported that 'a reserve-domain check or two-sided fee limit would have prevented the documented attack.' The exploit also targeted the pool's Algorithmic Market Operation (AMO) — the mechanism Optim Finance used to defend OADA's ADA peg — disabling the sole peg-defending mechanism in a single action. As of early reporting, Optim Finance had not publicly disclosed whether the vulnerability lay in Splash's contract code, the AMO integration, or both.","heading":"Technical Root Cause","severity":"critical","sources":[{"credibility":2,"name":"Cardano's Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"},{"credibility":2,"name":"Splash fixes exploit as 2.4M ADA remains missing — Grafa","type":"news_article","url":"https://grafa.com/en/news/crypto/splash-fixes-exploit-as-2-4m-ada-remains-missing"},{"credibility":2,"name":"Cardano's Splash Fix Patches Exploit, Leaves 2.4M ADA Missing — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/cardano-s-splash-fix-patches-exploit-leaves-2-4m-ada-missing"}]},{"content":"Splash Protocol released a validator patch after the exploit was identified, closing the documented attack vector. The patch addresses the three missing checks described in the root-cause analysis — reserve non-negativity, bidirectional fee bounds, and swap direction enforcement. However, as multiple sources confirmed, a code fix cannot restore funds already extracted from the pool. After the drain, the pool held only 10 ADA and approximately 1.44 million OADA. Splash's TVL dropped approximately 27 percent to around $3.3 million in the immediate aftermath, according to reporting that cited DeFiLlama data. Splash had not issued a public statement at the time of the earliest reporting on September 13, though details attributed to the protocol's own post-incident analysis circulated in subsequent coverage.","heading":"Splash Protocol Response and Patch","severity":"high","sources":[{"credibility":2,"name":"Cardano's Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"},{"credibility":2,"name":"Optim Finance Pauses OADA After Splash Pool Exploit Drains Cardano Liquidity — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity/"},{"credibility":2,"name":"Cardano's Splash Patches Exploit, 2.42M ADA Still Missing — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/cardano-s-splash-patches-exploit-2-42m-ada-still-missing"}]},{"content":"Optim Finance — which issues OADA, an ADA-pegged synthetic token, and sOADA, a yield-bearing variant — announced via X (formerly Twitter) on September 13, 2026 at approximately 06:57 UTC that its protocol was paused, all remaining OADA liquidity had been pulled from Cardano DeFi venues, and OADA-to-ADA swaps were unavailable. The protocol advised users to withdraw immediately and against providing liquidity. In a September 15 update, Optim Finance stated it was indexing the chain and compiling a full accounting of impacted addresses and assets. The September 15 statement described work 'oriented toward a resolution' but did not announce restored liquidity, a redemption mechanism, or restoration of operations. As of the latest available reporting, no compensation plan, timeline, or protocol-level redemption mechanism had been publicly announced. OADA holders are effectively unable to exit their positions. The exploit also dismantled the AMO mechanism that defended OADA's peg to ADA, removing the primary peg-stabilization tool. A secondary Minswap pool reportedly held approximately 1,763,923 OADA against only 45,751 FLDT at the time of the attack, creating arbitrage pressure that complicates any future liquidity replenishment effort.","heading":"Optim Finance Response and OADA Holder Impact","severity":"critical","sources":[{"credibility":2,"name":"Optim Finance Pauses OADA After Splash Pool Exploit Drains Cardano Liquidity — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity/"},{"credibility":2,"name":"Cardano's Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"}]},{"content":"Cardano's overall DeFi total value locked was approximately $55 million at the time of the exploit. Splash's roughly 27 percent single-day TVL decline to approximately $3.3 million was a significant proportional contraction for the protocol. Because OADA's peg-defending AMO operated through the Splash pool, the exploit simultaneously drained the pool and eliminated the mechanism designed to maintain OADA's 1:1 parity with ADA. This coupling meant that even OADA held outside the Splash pool had no clear protocol-level route back to ADA. The OADA/ADA stableswap had previously supported what one report described as approximately 9 million ADA in TVL as of July 2024, though the pool's exact state at the time of the September 2026 exploit was not independently disclosed by the protocols at the time of initial reporting.","heading":"Broader Cardano DeFi Ecosystem Impact","severity":"medium","sources":[{"credibility":2,"name":"Optim Finance Pauses OADA After Splash Pool Exploit Drains Cardano Liquidity — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity/"},{"credibility":2,"name":"Splash fixes exploit as 2.4M ADA remains missing — Grafa","type":"news_article","url":"https://grafa.com/en/news/crypto/splash-fixes-exploit-as-2-4m-ada-remains-missing"}]},{"content":"As of the most recent available reporting (approximately September 15, 2026), the following risks remain unresolved. First, approximately 2,424,778 ADA drained from the pool is missing with no publicly disclosed recovery or tracing effort beyond Optim Finance's statement that it was indexing affected addresses. Second, OADA holders have no confirmed protocol-level redemption mechanism; the only peg-defending liquidity pool has been drained. Third, the thin OADA secondary market on Minswap poses arbitrage risks that could harm any new liquidity providers if ADA were added to restore the pool without first addressing outstanding OADA supply. Fourth, while the Splash validator patch closes the documented exploit path, no independent audit confirming the fix's completeness had been publicly announced at the time of this writing. Fifth, no information about the attacker's identity, wallet address, or fund movements has been publicly released by either protocol. This page should be updated as Optim Finance publishes its full accounting of impacted addresses, any remediation or compensation plan, or as funds are traced or recovered.","heading":"Unresolved Risks and Ongoing User Harm","severity":"critical","sources":[{"credibility":2,"name":"Cardano's Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"},{"credibility":2,"name":"Splash fixes exploit as 2.4M ADA remains missing — Grafa","type":"news_article","url":"https://grafa.com/en/news/crypto/splash-fixes-exploit-as-2-4m-ada-remains-missing"},{"credibility":2,"name":"Cardano's Splash Patches Exploit, 2.42M ADA Still Missing — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/cardano-s-splash-patches-exploit-2-42m-ada-still-missing"}]},{"content":"Splash Protocol is an open-source decentralized exchange and AMM on the Cardano blockchain offering batched settlement and gas-efficient routing. It provides StableSwap pools designed for low-slippage trading between pegged assets. Optim Finance is a Cardano DeFi protocol that issues two synthetic ADA tokens: OADA, an ADA-pegged trading vehicle that does not accrue staking rewards, and sOADA, an un-pegged yield-bearing token whose redemption rate against OADA increases as protocol yield accrues. OADA is minted when users deposit ADA into the Optim system, and that ADA is deployed into yield-generating strategies via AMOs — including the Splash StableSwap pool that was exploited. Optim Finance received funding through Cardano Project Catalyst Fund 11 for the OADA product line. The two protocols were tightly integrated: the Splash ADA/OADA pool served as the primary liquidity and peg-maintenance mechanism for OADA, meaning the exploit's impact propagated immediately and directly into Optim Finance's product.","heading":"Background: Splash Protocol and Optim Finance","severity":"low","sources":[{"credibility":2,"name":"Optim Finance Pauses OADA After Splash Pool Exploit Drains Cardano Liquidity — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity/"},{"credibility":2,"name":"OADA and sOADA — Optim Finance GitBook","type":"official","url":"https://optim-finance.gitbook.io/optim-finance/oada/oada-and-soada"},{"credibility":2,"name":"Why OADA — Optim Labs on Medium","type":"official","url":"https://optim-labs.medium.com/why-oada-cba762f7e0bb"}]}],"sources_used":[{"credibility":2,"name":"Optim Finance Pauses OADA After Splash Pool Exploit Drains Cardano Liquidity — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity/"},{"credibility":2,"name":"Cardano's Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"},{"credibility":2,"name":"Cardano's Splash Fix Patches Exploit, Leaves 2.4M ADA Missing — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/cardano-s-splash-fix-patches-exploit-leaves-2-4m-ada-missing"},{"credibility":2,"name":"Cardano's Splash Patches Exploit, 2.42M ADA Still Missing — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/cardano-s-splash-patches-exploit-2-42m-ada-still-missing"},{"credibility":2,"name":"Splash fixes exploit as 2.4M ADA remains missing — Grafa","type":"news_article","url":"https://grafa.com/en/news/crypto/splash-fixes-exploit-as-2-4m-ada-remains-missing"},{"credibility":3,"name":"Cardano Splash Exploit Patched, but 2.4M ADA Remains Missing — Hokanews","type":"news_article","url":"https://www.hokanews.com/2026/09/cardano-splash-exploit-patched-but-24m.html"},{"credibility":2,"name":"OADA and sOADA — Optim Finance GitBook","type":"official","url":"https://optim-finance.gitbook.io/optim-finance/oada/oada-and-soada"},{"credibility":2,"name":"Why OADA — Optim Labs on Medium","type":"official","url":"https://optim-labs.medium.com/why-oada-cba762f7e0bb"},{"credibility":2,"name":"Cardano's Splash fix patches the exploit — CryptoNews.net","type":"news_article","url":"https://cryptonews.net/news/altcoins/33457091/"}],"summary":"On September 13, 2026, an attacker exploited a validator flaw in Splash Protocol's ADA/OADA StableSwap pool on Cardano, draining approximately 2,434,648 ADA and 1,988,222 OADA in two transactions. Splash subsequently patched the underlying vulnerability, but roughly 2.42 million ADA remains unrecovered and OADA holders are unable to redeem their positions as of mid-September 2026, with Optim Finance still auditing impacted addresses and no confirmed remediation path announced.","timeline":[{"date":"2026-09-13","event":"Attacker executes two transactions against Splash Protocol's ADA/OADA StableSwap pool on Cardano, draining 2,434,648 ADA and 1,988,222 OADA by exploiting a validator flaw that permitted negative tradable reserves and did not enforce swap direction.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity/"},{"date":"2026-09-13","event":"Optim Finance announces at approximately 06:57 UTC via X that its protocol is paused, all OADA liquidity has been removed across Cardano DeFi, and OADA-to-ADA swaps are unavailable. Users are advised to withdraw immediately.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/13/optim-finance-pauses-oada-after-splash-pool-exploit-drains-cardano-liquidity/"},{"date":"2026-09-13","event":"Following the exploit, the Splash ADA/OADA pool holds only 10 ADA and approximately 1.44 million OADA. Splash's TVL declines approximately 27% to around $3.3 million. Cardano DeFi TVL at approximately $55 million overall.","source":"CryptoTimes / CryptoSlate","source_url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"},{"date":"2026-09-15","event":"Optim Finance publishes an update stating it is indexing the chain and compiling a full accounting of impacted addresses and assets. No liquidity restoration, redemption mechanism, or compensation plan is announced.","source":"CryptoSlate","source_url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"},{"date":"2026-09-15","event":"Splash releases a validator patch closing the documented exploit path, addressing the missing reserve non-negativity check, the unidirectional fee bound, and the absent swap-direction enforcement. Approximately 2,424,778 ADA remains unrecovered.","source":"CryptoSlate / KuCoin News","source_url":"https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/"}]},"v":1}