The TWAMM bug and the refunds
A bug in the DCA sale cost users money and forced the DAO to reach quorum before it could act. Five proposals covering the fix, the refunds and the cleanup.
Part of a series covering all 72 Ekubo DAO proposals. This post covers the incident that governance was switched on to deal with, and is dated to the last proposal in it.
Period covered: June – July 2024.
What happened
EKUBO’s distribution ran partly through a TWAMM — a time-weighted average market maker, the mechanism behind Ekubo’s DCA orders — selling the DAO’s tokens gradually rather than in one block. In May 2024, a bug was found in the TWAMM math. Some users overpaid.
The fix required a contract upgrade. The upgrade required a proposal. The proposal required a 5M quorum against a circulating supply of about the same size. That is the sequence described in Turning on the DAO: the bug is why the first vote had to happen, and the difficulty of the first vote is why the DAO later spent 180,000 STRK thanking the people who showed up for it.
The DAO’s own estimate at the time was that fixing the execution of the remaining 3M EKUBO sale was worth up to 5% — roughly $200,000. The fix paid for the effort of passing it.
The refunds
Once governance could act, it acted three times in two days.
On July 2, 2024, separate proposals refunded ETH and USDC DCA orders. On July 3, STRK.
Each did the same three things: withdraw the proceeds from the DCA order, withdraw the governor’s own liquidity from the TWAMM pool, and refund the users who overpaid.
Splitting one remediation into three proposals — one per asset — is worth noting. It is slower and it triples the number of votes. It also means a mistake in the ETH calldata cannot take the USDC refund down with it, and each refund is independently auditable against its own pool. For a DAO that had just discovered its contracts could be wrong, spending three votes instead of one was cheap.
The one that didn’t pass
The first attempt, June 11, 2024 — “Withdraw Proceeds from DCA orders” — did not execute. It was narrow housekeeping: collect the proceeds into the governor contract so later proposals could spend them without each one having to handle collection.
It is the DAO’s second-ever proposal and its first failure, ten days into the DAO’s existence. The work it described happened anyway, folded into the refund proposals that followed and then completed by Withdraw all proceeds from active TWAMM orders on July 31, which pulled everything into the treasury and burned the TWAMM positions to simplify accounting.
What it established
Three patterns visible here recur through the next two years of proposals.
Ekubo, Inc. executes, the DAO authorises. The refunds were distributed off-chain to identified users rather than through a claim contract. That pattern — the DAO approves an amount and a purpose, a named party carries it out and returns the remainder — becomes the default for almost everything involving Ethereum, and it is the reason so many later proposals read “transfer to Ekubo Inc.’s deployer address.”
Discussion happens on Discord, the record lives on-chain. Every one of these proposals links to a Discord thread. The proposal text is a summary; the argument is elsewhere. That is convenient and it is also the weakest part of the archive — Discord links rot, and the on-chain record keeps only the conclusion.
The DAO refunds when it doesn’t have to. Nothing compelled these refunds. The same instinct shows up again in Refund all EVM v1 revenue in March 2025, when the DAO returned roughly $2,500 of protocol revenue to the users who paid it after a short-lived deployment, and again in the $300k Recovery Fund in June 2026.
The proposals
| Date | Proposal | Outcome |
|---|---|---|
| Jun 11, 2024 | Withdraw Proceeds from DCA orders | Did not pass |
| Jul 2, 2024 | Refund ETH DCA orders | Executed |
| Jul 2, 2024 | Refund USDC DCA orders | Executed |
| Jul 3, 2024 | Refund STRK DCA orders | Executed |
| Jul 31, 2024 | Withdraw all proceeds from active TWAMM orders | Executed |