On January 21, 2023, Omm protocol on Icon was exploited for $1.891M when the Redeem function accepted arbitrary collateral addresses without ownership validation. The attacker could withdraw collateral from any pool regardless of whether they owned positions in it.