Osmosis confirms bOSMO a redemption contract vulnerability and will compensate 1037 accounts with approximately 40500 tokens OSMO

AT A GLANCE

The report stated that bOSMO the redemption contract has a repeated-counting vulnerability and Osmosis plans to compensate 1037 accounts with approximately 40,508 tokens OSMO。

Article

Osmosis discovers bOSMO a redemption contract vulnerability and will compensate 1037 accounts with approximately 40500 tokens OSMO BlockBeats reports that,October 16, according to a disclosure by Osmosis Community Hall,Backbone Labs the liquid staking token issued by bOSMO has a redemption contract vulnerability. Since 2026 April year, each redemption by the contract has repeatedly counted the OSMO staked by Backbone's own validators, causing redeeming users to actually receive OSMO approximately 50%more than they were entitled to; the additional payments were borne by other bOSMO holders. To avoid further harming the interests of other holders when redeeming from the community pool, the relevant parties on October 10 redeemed approximately 776000 tokens of bOSMO, withdrawing approximately 1299700 tokens of OSMO. The OSMO involved in this redemption is expected to complete unbonding on October 24.

Osmosis stated that it will compensate users at a ratio of bOSMO per 1.1174 tokens of OSMO held by bOSMO accounts at the time of the snapshot, totaling approximately 1037 accounts and 40,508 tokens of OSMO. The funds will be distributed automatically after October 24 unbonding is complete, and users need not take any action. However, after the redemption, the asset backing of bOSMO has declined substantially; redeeming bOSMO through Backbone currently yields only approximately 0.06 tokens of OSMO. As the vulnerability has not been fixed, the market can still mint new 0.039 at a cost of approximately OSMO tokens of bOSMO, and some liquidity pools may be priced significantly above the actual redemption value. Osmosis therefore advises users not to purchase bOSMO or provide liquidity to the relevant liquidity pools, and advises existing liquidity providers to withdraw their funds.

Original link https://m.theblockbeats.info/flash/372160

Key points

BlockBeats reported that, according to a disclosure by Osmosis Community Hall,Backbone Labs issued by bOSMO has a redemption contract vulnerability.
Since 2026 year, each redemption by the contract has repeatedly counted April staked by Backbone's own validators.OSMO。
Redeeming users actually received OSMO approximately more than they were entitled to 50%, and the additional amount was borne by other bOSMO holders.
The relevant parties on October 10 redeemed approximately 776000 tokens of bOSMO, withdrawing approximately 1299700 tokens of OSMO; the relevant OSMO is expected to complete unbonding on October 24.
Osmosis stated that it will compensate at a ratio of bOSMO per 1.1174 tokens of OSMO held at the time of the snapshot by 1037 accounts, totaling approximately 40,508 tokens OSMO。
Osmosis stated that compensation will be distributed automatically after October 24 unbonding is complete, and users need not take any action.
Redeeming bOSMO through Backbone currently yields only approximately 0.06 tokens of OSMO; as the vulnerability has not been fixed, the market can still mint new 0.039 tokens of OSMO at a cost of approximately bOSMO。
Osmosis advises users not to purchase bOSMO or provide liquidity to the relevant liquidity pools, and advises existing liquidity providers to withdraw their funds.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Simply put, the contract counted the same staked assets toward the redemption amount more than once, allowing some redeemers to receive an extra OSMO; the loss was borne by other bOSMO holders. Osmosis said it will compensate accounts holding the tokens at the time of the snapshot, but the current bOSMO redemption value has already declined significantly, and the vulnerability remains unfixed.

Why it matters to readers

This means the market price of bOSMO may be higher than its actual redeemable value. Continuing to purchase or provide liquidity may expose users to insufficient asset backing and pricing deviation risk.

Beginners holding or preparing to trade bOSMO should clearly distinguish between “market price” and “actual redemption value” and note Osmosis's advice to pause purchases and withdraw liquidity.

Risks and unknowns

The evidence is a BlockBeats relay and does not provide an original Osmosis Community Hall announcement link that can be independently verified.
Unable to confirm from the evidence when the vulnerability will be fixed.
Unable to confirm from the evidence October 24 whether the unbinding and automatic compensation were ultimately completed as planned.
Unable to confirm from the evidence whether the compensation can cover all affected losses.
The specific degree of price deviation for some liquidity pools has not been disclosed.

Osmosis confirms bOSMO a redemption contract vulnerability and will compensate 1037 accounts with approximately 40500 tokens OSMO

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center