Backbone Labs bOSMO contract vulnerability leads to support exhaustion, Osmosis announces compensation plan

The liquid staking token bOSMO issued by Backbone Labs nearly exhausted its contract support after a large redemption in the Osmosis community pool. A disclosure on the Osmosis forum on October 15 revealed that approximately 40,508 OSMO were designated for compensation to 1,037 accounts. The disclosure author Johnny Wyles stated that the staking contract has overpaid for each redemption since at least April 2026, settling at approximately 1.676 OSMO per bOSMO, while the declared exchange rate of the contract was about 1.117 OSMO.

The vulnerability repeatedly counted the OSMO staked on Backbone's own validators, allowing redeemers to receive about 50% more assets, at the cost of diluting the support for remaining holders. The defect was exposed when preparing to liquidate the community pool position, and the passed governance proposal 1049 authorized the withdrawal of the Margined managed treasury position and the destruction of the reclaimed OSMO when it ceased managing liquidity operations. The pool's bOSMO treasury holds approximately 1.137 million bOSMO, accounting for about 97% of the total supply of the token; the redemption transaction executed on October 9 at 21:59 ET destroyed 776,000 bOSMO and began unbinding approximately 1.3 million OSMO.

Compensation is based on the qualified balance at block 72,237,940, calculated at 1.1174 OSMO per bOSMO. bOSMO purchased after the snapshot is not included in the compensation, and underlying holders in the liquidity pool and other contracts are also included;