【Technical Perspective】Osmosis discovers vulnerability in bOSMO redemption contract; 1,037 accounts to receive compensation of approximately 40,500 OSMO
Osmosis recently disclosed that the redemption contract for bOSMO, a liquid staking token issued by Backbone Labs, contains a vulnerability. Since April 2026, the contract has repeatedly double-counted OSMO staked by Backbone’s own validators during each redemption, causing users to receive approximately 50% more OSMO than they were entitled to. The excess payments were borne by other bOSMO holders.
To prevent further harm to other holders from redemptions using the community pool, the parties involved redeemed approximately 776,000 bOSMO in a single transaction on October 10, withdrawing approximately 1.2997 million OSMO. The OSMO involved in this redemption is expected to complete its unbonding on October 24.
According to Osmosis’s announcement, the platform will compensate 1,037 accounts holding bOSMO with approximately 40,500 OSMO, at a rate of 1.1174 OSMO per bOSMO based on the snapshot. The compensation will be distributed automatically after unbonding is complete on October 24; users do not need to take any action.
Following the disclosure of the vulnerability, bOSMO’s asset backing has fallen sharply. Redeeming through Backbone currently yields only approximately 0.06 OSMO per bOSMO. Because the vulnerability has not yet been fixed, new bOSMO can still be minted at a cost of approximately 0.039 OSMO, and prices in some liquidity pools may be significantly higher than the actual redemption value.
Osmosis advises users not to buy bOSMO or provide liquidity to related pools for now, and recommends that existing liquidity providers consider withdrawing their funds.
Osmosis recently disclosed that the redemption contract for bOSMO, a liquid staking token issued by Backbone Labs, contains a vulnerability. Since April 2026, the contract has repeatedly double-counted OSMO staked by Backbone’s own validators during each redemption, causing users to receive approximately 50% more OSMO than they were entitled to. The excess payments were borne by other bOSMO holders.
To prevent further harm to other holders from redemptions using the community pool, the parties involved redeemed approximately 776,000 bOSMO in a single transaction on October 10, withdrawing approximately 1.2997 million OSMO. The OSMO involved in this redemption is expected to complete its unbonding on October 24.
According to Osmosis’s announcement, the platform will compensate 1,037 accounts holding bOSMO with approximately 40,500 OSMO, at a rate of 1.1174 OSMO per bOSMO based on the snapshot. The compensation will be distributed automatically after unbonding is complete on October 24; users do not need to take any action.
Following the disclosure of the vulnerability, bOSMO’s asset backing has fallen sharply. Redeeming through Backbone currently yields only approximately 0.06 OSMO per bOSMO. Because the vulnerability has not yet been fixed, new bOSMO can still be minted at a cost of approximately 0.039 OSMO, and prices in some liquidity pools may be significantly higher than the actual redemption value.
Osmosis advises users not to buy bOSMO or provide liquidity to related pools for now, and recommends that existing liquidity providers consider withdrawing their funds.