Cardano Stablecoin Pool Drained of $2.4M in ADA
Cardano-based stablecoin OADA's $ADA/OADA StableSwap pool was drained of 2,434,648 ADA on September 13. The attacker used two transactions to remove the funds, leaving behind a negative tradable ADA reserve and a unchanged LP token balance.
The incident report noted that the pool's validator did not require the tradable ADA reserve to remain positive and did not enforce fee changes in one direction. These missing checks allowed the validator to accept a transaction after the tradable ADA reserve had turned negative, allowing the attacker to drain the funds.
A code patch has since been implemented to fix the exploit, but it does not restore the lost ADA or provide an exit for OADA holders. The pool's liquidity is still severely depleted, with only 10 ADA and about 1.44 million OADA remaining in the pool.