Author: Stake DAO Association
Summary
On May 27, 2026, a compromised deployer account was used to forge an unbacked cross-chain mint of vsdCRV on Arbitrum. A full report of the incident is available here. The backing of legitimate vsdCRV (approximately 1,329,056 staked sdCRV) was secured to the governance Safe within 47 minutes and was promptly secured.
As with all DeFi protocols, interactions with smart contracts involve inherent technical risks, including vulnerabilities or exploits. This distribution is proposed purely as a voluntary, ex gratia community support measure. It does not constitute, and shall not be construed as, an admission of liability, fault, negligence, or legal responsibility by the Stake DAO Association, its members, contributors, service providers, or any affiliated entity, nor a waiver of any defence or right. Nothing in this proposal creates any obligation, entitlement, or expectation of compensation, whether in respect of this incident or any future event.
This proposal authorizes the DAO to provide voluntary, ex gratia support to affected users in the aggregate amount of 1,535,421.76 sdCRV (approximately $173,000 as of the date of this proposal, stated for information only and subject to market fluctuation), across 242 affected addresses. Any distribution is made on a discretionary, ex gratia basis and, where accepted, in full and final satisfaction of any and all claims the recipient may have arising out of or relating to the May 27, 2026 incident.
Context
Following the forged mint, the vsdCRV backing held on Ethereum mainnet (approximately 1,329,056 staked sdCRV) was secured to the vsdCRV governance Safe. This recovered backing is now available to compensate affected users, and represents the large majority of the funds required.
For the avoidance of doubt, the sdCRV applied from the secured vsdCRV backing is no longer required to support outstanding vsdCRV, and its use for this distribution fulfills the redemption right of legitimate vsdCRV holders.
The remaining gap is covered by sdCRV from the Stake DAO treasury. Compensation is proposed entirely in sdCRV: it represents the overwhelming majority of what was lost, and, given current market conditions, paying in sdCRV avoids reducing the DAO’s runway.
Proposal
Authorize the treasury committee to distribute compensation to the 294 addresses affected by the May 27, 2026 incident, as identified in the incident report, for a total of 1,535,421.76 sdCRV.
The compensation will be funded as follows:
| Source | sdCRV |
|---|---|
| sdCRV recovered from the secured vsdCRV backing | 1,329,056.00 |
| Additional sdCRV from the Stake DAO treasury | 206,365.76 |
| Total compensation | 1,535,421.76 |
The distribution is made 100% in sdCRV and applies only to addresses directly affected by the May 27, 2026 incident, as determined by reference to the on-chain states between timestamps 1779873467 and 1779876740, at the following blocks:
| Chain | Pre-hack block | Post-hack block |
|---|---|---|
| Arbitrum | 467160930 | 467166978 |
| Mainnet | 25185719 | 25185846 |
| Polygon | 87505868 | 87506868 |
Addresses whose allocation would fall below 100 sdCRV (approximately $10) are excluded for administrative efficiency and because the gas cost of claiming such low amounts would offset all or most of the value distributed. The list of eligible addresses and corresponding allocations is available here. Affected users may submit corrections during the voting period; the final eligibility list and allocations are determined by the treasury committee in its reasonable discretion and are not subject to appeal thereafter. The treasury committee may correct manifest errors in the list at any time.
Claim Mechanism
The compensation will be made available through a Merkl tree contract on Ethereum mainnet (as sdCRV does not exist on Arbitrum). Affected users will be able to claim their sdCRV directly from this airdrop. As with all airdrops, the claim will remain open for 6 months, after which it will be closed.
Claiming is subject to the following conditions. By claiming, each recipient acknowledges and agrees that (i) the distribution is voluntary and ex gratia and is accepted in full and final satisfaction of any and all claims the recipient may have against the Stake DAO Association and its members, contributors, and affiliates in connection with the May 27, 2026 incident; (ii) the recipient is not located in, organized under the laws of, or ordinarily resident in any jurisdiction subject to comprehensive sanctions, and is not a person or entity that is the target of any applicable sanctions (including those administered by the EU, the United States (OFAC), the United Kingdom, or the United Nations); and (iii) the recipient is solely responsible for any taxes arising from the distribution. Any allocation that is not claimed within the six-month claim window, or that cannot lawfully be distributed, will be returned to the Stake DAO treasury, and the recipient waives any further entitlement to it.
Proposal Specifications
3 days veSDT holders Community Feedback followed by a 7-day voting period, standard governance quorum and majority.
Voting Options
- YAE: Authorise the treasury committee to proceed with the reimbursement of affected users.
- NAE: Rework the proposal with another solution.
- ABSTAIN: No preference.
Disclaimers
This proposal does not constitute a financial product or investment solicitation.
All transfers are executed on-chain through transparent and auditable smart contracts.
The Stake DAO Association acts as a decentralised coordination framework and does not provide financial, fiduciary, or investment services to users. All assets relevant to this distribution are held in governance-controlled, on-chain multisignature Safes and are administered solely pursuant to community governance.
- Distributions are subject to applicable law and to sanctions and compliance screening. The treasury committee may withhold, delay, or decline any distribution to any address where screening or legal advice indicates that distribution would or may breach applicable sanctions, anti-money-laundering, or other legal requirements, and may exclude such addresses without further notice.
- This proposal does not constitute tax advice. Recipients are solely responsible for determining and discharging any tax obligations arising from the distribution. Neither the Stake DAO Association nor any affiliate makes any representation regarding the tax treatment of the distribution and will not withhold or account for any tax.
- References to fiat values (e.g., USD amounts) are approximate, provided for information only as of the date of this proposal, and do not constitute a representation or warranty as to value. The value of sdCRV fluctuates and may differ materially at the time of claim.
- Approval of this proposal authorizes, but does not guarantee, distribution. The treasury committee may pause, amend, or discontinue the distribution for legal, regulatory, technical, or security reasons, and is not obliged to proceed where doing so would create legal or regulatory risk.
- Allocations are pseudonymous on-chain addresses; the Association processes them solely to administer this distribution and in accordance with applicable data-protection law.