Cardano’s Splash fix patches the exploit, but leaves 2.4M ADA missing and holders trapped

Three days after Splash’s Cardano-based ADA/OADA StableSwap pool was drained, OADA holders still faced a problem that corrected code alone could not solve: the pool had lost the ADA that provided their meaningful route out of the token.Splash’s incident report said one actor used two transactions on Sept. 13 to remove 2,434,648 ADA and 1,988,222 OADA. After subtracting the attacker’s 9,870 ADA deposit, but before network fees, the ADA drain was 2,424,778.Why a code patch is not a liquidity fixThe pool’s validator calculated a “tradable” reserve by subtracting accrued protocol fees from its real balances. According to Splash, it did not require that reserve to remain positive, bounded fee changes only from below and did not enforce the direction of a swap.Those missing checks allowed the validator to accept a transaction after the tradable ADA reserve had turned negative. Splash said a reserve-domain check or a two-sided fee bound would have stopped the reconstructed attack.Either fix would close the documented exploit path. Neither would return the ADA that had already left the pool. Immediately after the drain, the pool held 10 ADA and about 1.44 million OADA, while its tradable A...