Status: active-risk research snapshot, not a recovery or execution runbook.
Chain: Osmosis osmosis-1
Observed height: 66043835 (2026-07-11T03:10:37.580963456Z)
Governance contract: osmo1k8re7jwz6rnnwrktnejdwkwnncte7ek7gt29gvnl3sdrg9mtnqkse6nmqm
Eighteen open, zero-message proposals (#22–#39) were created by one address in roughly 21.5 minutes. Their recorded proposal deposits total 662 ION even though the configured full deposit is 0.5 ION each.
Normal full deposits for this batch would total 9 ION. The difference is 653 ION of apparent future claim exposure.
This is not proof of an executed theft. At the observation height, every proposal was still open and deposit_claimable=false. The exposure materializes only if a proposal reaches a normal executable/closable lifecycle result and a claim is made. Treat it as an active, under-collateralized DAO-liability risk—not as a completed loss.
| Item | Observed value |
|---|---|
| Governance contract CW2 metadata | crates.io:ion-dao 0.0.1 |
| CosmWasm code ID | 3 |
| Contract admin | none |
| Proposal IDs | 22 through 39 inclusive |
| Proposer | osmo1fuzlaeajk7t80ujags2c3jlfemauwqg3s6t7dk |
| Proposal messages | 0 on all 18 |
| Votes | 0 on all 18 at snapshot |
| Configured full deposit | 0.5 ION |
| Recorded deposits | 662 ION |
| Normal aggregate deposit | 9 ION |
| Apparent excess claim exposure | 653 ION |
| Governance-contract liquid balance | 1,931.931671 ION |
| Snapshot voting weight | 1,671.832757 ION |
| 30% veto threshold | 501.549828 ION |
The proposal burst began in block 65993043 at 2026-07-10T11:09:01.637679233Z and ended in block 65994188 at 2026-07-10T11:30:35.219444065Z.
The labels and amounts follow the same simple pattern: recorded deposit equals the stated gap plus the 0.5 ION base deposit.
| Example | Labelled gap | Recorded deposit |
|---|---|---|
#22 |
0.5 ION |
1.0 ION |
#23 |
10 ION |
10.5 ION |
#24 |
44 ION |
44.5 ION |
#25–#39 |
43.5 down to 36 ION |
44.0 down to 36.5 ION |
That is not a credible capital requirement for blank governance proposals. It is the signature expected from a deposit record that is larger than the value actually retained by the DAO.
The public repository linked by the ION DAO site is many-things/ion-dao-contracts. The deployed contract metadata and query interface match the legacy v0.0.1 implementation examined here.
The relevant source flow is:
- proposal creation records the entire submitted amount as the proposer deposit;
- after the base deposit is satisfied, the excess submitted amount is refunded immediately;
- the stored deposit record is not reduced by that immediate refund;
- later deposit-claim logic pays the stored record.
This creates a mismatch between net collateral retained and future claim record. The batch appears designed around that mismatch.
Proof boundary: code ID, code hash, CW2 metadata, contract config, proposal state, deposit records, and balances were queried directly from chain endpoints. The public source was not reproduced byte-for-byte into the deployed wasm, so the source-level explanation is strong corroboration—not a formal reproducible-build proof.
There is no automatic refund or confiscation while these proposals remain open.
| Outcome after expiry | Follow-up action | Deposit consequence under the examined code path |
|---|---|---|
| Passes | execute |
Stored deposit becomes claimable |
| Ordinary rejection / no quorum | close |
Stored deposit becomes claimable |
| Reaches the veto threshold | close |
Deposit is confiscated rather than claimable |
| Proposal fails only because it never met a deposit requirement | close |
Confiscated; not applicable to this funded batch |
A plain No vote or no quorum is therefore not a safety mechanism. It leads to ordinary rejection, which can still make the recorded deposit claimable after close.
- Coordinate Veto voting on every proposal
#22–#39before each voting deadline. The recorded threshold was501.549828 IONof voting power per proposal. - Do not treat routine rejection or a plain No vote as sufficient protection.
- Do not close a non-vetoed proposal casually: closing is the lifecycle action that can open claimability.
- Do not rely on increasing the nominal deposit amount. The issue is accounting consistency, not simply a low threshold.
- The contract had no admin at the observation height. A replacement/migration plan needs separate governance and treasury controls; it cannot be waved through with an in-place admin migration.
No wallet access, vote, transaction signing, execution, or broadcast was performed for this research.
| Evidence | Direct chain source |
|---|---|
| Contract / code metadata | https://osmosis-lcd.nosnode.com/cosmwasm/wasm/v1/contract/osmo1k8re7jwz6rnnwrktnejdwkwnncte7ek7gt29gvnl3sdrg9mtnqkse6nmqm and /cosmwasm/wasm/v1/code/3 |
| Proposal state | CosmWasm smart queries against the governance contract at https://osmosis-lcd.nosnode.com |
| First burst block | https://osmosis-rpc.nosnode.com/block?height=65993043 and /block_results?height=65993043 |
| Last burst block | https://osmosis-rpc.nosnode.com/block?height=65994188 and /block_results?height=65994188 |
| Observation block | https://osmosis-rpc.nosnode.com/block?height=66043835 |
| Public source reference | many-things/ion-dao-contracts commit 6928f6e706033c7e9208410406886c2b42209736 |
The curated machine-readable snapshot is in evidence/onchain-snapshot.json. It intentionally contains only material research facts, not private operator notes or credentials.