Neutron asset restitution: return the recovered funds to the original contracts

Original Proposal Text

This is a text proposal. It executes no messages. If it passes, Neutron governance authorizes the signers of the Neutron recovery multisig, `neutron1yr29fd7uzdjp2jsq8hrta8mvyd6ex7vumn0shy`, to: - return the funds recovered after the 22 September governance attack to the contracts they were taken from, in the amounts below; - send the NTRN clawed back from the attacker's voting wallet to the community pool. ## Background On 22 September 2026 an attacker passed Neutron governance proposal 9 with stake bought for about 20,199 USDC. The proposal handed 11 contracts to the attacker, who emptied ten of them. Neutron validators halted the chain the same morning. The recovery release on 25 September did three things: - it restored all 11 contracts to their original code and admins; - it moved the stolen funds still on Neutron, and the attacker's purchased stake, to the Neutron recovery multisig; - it locked both attacker accounts. Cosmos Hub proposal 1058 then sent the ATOM recovered on the Hub to the same multisig. The multisig signers are 01node, Stake&Relax, Polkachu, Newt Node and Solva. They hold the funds as technical custody and will move them only with a mandate from Neutron governance. This proposal is that mandate. ## What was recovered | Asset | Taken | Recovered | Share | |---|---:|---:|---:| | ASTRO | 370,318,691.39 | 370,318,691.39 | 100% | | NTRN | 95,196,289.99 | 95,196,289.99 | 100% | | dATOM | 1,592,481.67 | 1,592,481.67 | 100% | | ATOM | 1,723,180.29 | 1,227,121.22 | 71.21% | | axlWETH | 20.088467 | 14.088467 | 70.13% | | USDC | 2,852,311.71 | 1,672,301.71 | 58.63% | | wstETH | 15.990652 | 0.000000294 | ~0% | | DYDX | 803,955.14 | 0 | 0% | The rest was sold or bridged away by the attacker before the halts. The USDC figure includes 1,000 USDC that the attacker sent to the wallet of an unrelated voter on proposal 9. The owner of that wallet had no part in the attack and returned the 1,000 USDC to the recovery multisig voluntarily. ## How the funds are split Each recovered asset is split across the contracts it was taken from, in proportion to the amount taken from each. Assets that were fully recovered go back in full. Every contract therefore takes the same haircut on the same asset. Nothing is swapped or priced, and no contract receives more than its share of any asset. ## Transfers | Taken from | Sent to | Amount | |---|---|---| | Astroport Staking (xASTRO) | Astroport Treasury `neutron19sq60cxtsjcx7vw25c63wyt27fxevuh6l7vxcn04u0t0rueyfpvq4mc75l` | 370,318,691.388430 ASTRO, 0.001000 xASTRO, 0.000013 NTRN | | Astroport USDC/dATOM | `neutron1nfns3ck2ykrs0fknckrzd9728cyf77devuzernhwcwrdxw7ssk2s3tjf8r` | 1,301,226.788475 USDC, 849,315.856190 dATOM, 0.001000 LP, 0.001000 TIA, 0.000012 NTRN | | Astroport axlUSDC/USDC | `neutron1ns2tcunrlrk5yk62fpl74ycazanceyfmmq7dlj6sq8n0rnkuvk7szstkyx` | 293,149.064217 USDC, 0.007141 axlUSDC, 0.000012 NTRN | | Astroport USDC/DYDX | `neutron1j4xpv03fw664mvntlhqnzp5hjqk2nfw00vrgx9qlq97rxc9fu3lqvmszl2` | 66,010.010374 USDC, 0.000100 TIA, 0.000013 NTRN | | Astroport wstETH/axlWETH | `neutron1yw0a7nxa8jdgzmdsme4gwxhj76n44z305qgwrzvlfavgna9epcys3k9m2f` | 14.088467067160856016 axlWETH, 0.000000293993098793 wstETH, 0.000013 NTRN | | Astroport ATOM/dATOM | `neutron1yem82r0wf837lfkwvcu2zxlyds5qrzwkz8alvmg0apyrjthk64gqeq2e98` | 12,526.427176 ATOM, 7,828.609752 dATOM, 0.001000 LP, 0.001000 TIA, 0.000014 NTRN | | Astroport USDC/NTRN | `neutron18c8qejysp4hgcfuxdpj4wf29mevzwllz5yh8uayjxamwtrs0n9fshq9vtv` | 11,915.849891 USDC, 18,972,530.803703 NTRN, 0.001000 LP | | Drop dATOM to ATOM converter | `neutron15024sa6het7qrgccrx9wtxff7mh9qrcu9m6gvvlvez6em46ylscqk4kqj9` | 1,132,074.943483 ATOM, 735,337.205615 dATOM | | Drop withdrawal manager | `neutron1gcklauurx4ckyp0t8a6axl0500vy3n09y5utpspjg8ruxnln8erq2uumck` | 82,519.849341 ATOM, 0.000014 NTRN | | Neutron investor vesting | `neutron14q5elxj4ghktt7d7d0uw0cs0gqyeay25h5fkree897gjm38gevxqmvqsq5` | 76,223,759.185198 NTRN, 429.157300 ECLIP | | Attacker's voting wallet (not a contract) | Community pool | 31,647,287.024112 NTRN | These are the exact amounts, dust included. The ATOM is the 1,227,121.22 ATOM the Neutron recovery multisig received from the Hub. The xASTRO, LP, TIA, axlUSDC and NTRN dust are the balances taken from each contract. axlWETH and wstETH use 18 decimals, and every other amount uses 6. ## How each protocol pays out This proposal sets only the amounts and destinations. Each protocol decides how its contracts pay users out, through its own admin. For reference, the protocols have announced the following: - **Astroport Staking.** Astroport has deprecated xASTRO. Staking after the restart broke its share accounting, because the contract held no ASTRO at the time. The ASTRO therefore goes to the Astroport Treasury. Astroport will send ASTRO directly to each wallet that held xASTRO before the attack, at the rate that applied then. - **Astroport pairs.** The funds go back into each pool, and LPs withdraw their share through the pool as usual. The USDC/DYDX pool gets only USDC, and the wstETH/axlWETH pool gets almost only axlWETH. Astroport will switch the pairs to withdraw-only mode before they are refilled: no swaps, no deposits, and proportional withdrawals only. The pools come back at their 22 September prices, with different haircuts on each side, and some are left almost one-sided. Open for trading, they could be drained by arbitrage or by inflating LP shares. - **Drop converter.** The owner pauses the converter before it is refilled. Before reopening, it lowers the rate in proportion to the ATOM recovered, from 1.301309 to about 0.9267 ATOM per dATOM. Every dATOM holder then shares the ATOM haircut, including LPs whose dATOM comes back in full. - **Drop withdrawal manager.** The manager pays a fixed amount per voucher. Unless Drop ships a change that applies the same ratio to every voucher, claims are paid in the order they arrive until the ATOM runs out. Most of these vouchers have been unclaimed for months. - **Investor vesting.** The returned NTRN covers every unvested and unclaimed amount, so vesting continues unchanged. The contract pays out only NTRN, so the ECLI tokens stay in the contract unless its admin later moves it. ## Execution 1. The signers send exactly the amounts above to the addresses above. Any other destination or amount needs a new Neutron proposal. 2. All assets for one destination go in a single transaction, so a pool never receives only one side. 3. The signers agree the timing of each transfer with the receiving contract's admin, so that the Drop converter is paused and the Astroport pairs are in withdraw-only mode before they are refilled. Destinations may be served in any order. 4. The community pool transfer uses `MsgFundCommunityPool` and may be sent at any time. 5. After all transfers, the multisig holds nothing except fee dust. ## What this proposal does not do - It does not swap, sell or price any asset. - It does not change any contract. - It does not compensate losses that were not recovered. ## Vote options - Yes: return the funds as described. - No: the funds stay in the multisig until a different proposal passes. - No with veto: reject the proposal as spam or as a violation of Neutron's values, and burn the deposit. - Abstain: count toward quorum without taking a side. ## Links - Neutron incident post-mortem: https://x.com/i/status/2104924316357841306 - Cosmos Hub proposal 1058: https://www.mintscan.io/cosmos/proposals/1058