A Cosmos Hub governance proposal calling for the return of 1,221,120 ATOM tied to the Neutron attacker is drawing an almost unanimous veto.
By 2:34 p.m. ET on Friday, "No with Veto" accounted for about 95% of the roughly 69.3 million ATOM cast on proposal 1056. About 174,300 ATOM had been cast in favor. The proposal, posted on-chain at 7:20 p.m. ET on Wednesday, is titled "ATOM Refund & Justice Bounty."
Proposal asks for 1,221,120 ATOM back and adds a 500,000 ATOM bounty
The text says Cosmos Hub representatives coordinated validators to unjustifiably take 1.2 million ATOM from the attacker’s address, and it asks for 1,221,120 ATOM to be returned.
It also offers a 500,000 ATOM "Justice Bounty" to yes voters. That bounty would be split by staking weight, paid over six months, and capped at 5,000 ATOM per voter.
The message attached to the proposal would send 1,721,120 ATOM from the Hub’s community pool to the address that submitted it. According to Unchained, that address is different from the address the Hub previously swept.
How the ATOM was taken into Hub control
The ATOM came from Neutron, where a governance vote that closed on the night of Sept. 21 gave the attacker admin control of contracts run by Astroport and Drop.
Validators then halted and restarted the chain. During the Wednesday restart, the address’s remaining 1,227,121 ATOM was moved into a 4-of-6 multisig.
In its weekly update on Thursday, the Hub team said there was no vulnerability on the Cosmos Hub and that the patched software touched exactly one account.
Any movement of the funds now requires approval from four of the six multisig signers. All six are Hub validators: Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu.
Attacker address also received a THORChain refund
At 8:07 a.m. ET on Wednesday, minutes after the restart, the attacker’s address received 168,990.9 ATOM back from THORChain.
The attacker had put 200,000 ATOM into a THORChain swap for ETH on Sept. 22. THORChain records show about 19.9 ETH went out before the swap hit its price limit, and the rest was refunded.
At 1:54 p.m. ET on Wednesday, the attacker sent 168,990 ATOM over IBC to an Osmosis address.
Vote closes Sept. 30, turnout remains below threshold
Voting on proposal 1056 closes on Sept. 30.
If turnout remains below 40% of staked ATOM, the proposal fails. Turnout stood at about 21% on Friday afternoon.
If turnout reaches the threshold and "No with Veto" stays above 33.4% of the vote, the proposal still fails, and its 500 ATOM deposit is burned.