Upgrades, bugs and a recovery fund

Part of a series covering all 72 Ekubo DAO proposals. This post covers upgrading contracts that hold other people’s money, and carries the closing tally for the whole archive.

Period covered: August 2024 – July 2026.

Routine upgrades, and what they carried

Four upgrades in 2024 read as housekeeping, and each carried something worth noting.

Upgrade Core Contracts (August 2024, v3.1.0) added Core#forward and removed TWAMM’s direct order-placement methods in favour of it. Consolidating extension calls behind one entrypoint is what later makes an extension like Ve33 practical.

v3.3.2 (November 2024) moved to Cairo v2.8.4 and added inspection of a locker’s balance deltas. v3.3.8 (December 2024) made the oracle cheaper by dropping mathlib calls and let limit orders be created through the Positions contract.

The one where pools were frozen

Between those two sits November 20, 2024: Upgrade to v3.3.3 and unfreeze pools.

The sequence is three steps in one proposal: upgrade Core to a purpose-built migration contract, trigger the migration, then upgrade again to a version that unfreezes the affected pools.

Some pools were frozen and could not be unfrozen without governance. That means user liquidity was immobilised while a proposal was written, voted on and executed — under the parameters in force at the time, a multi-day window. The governance timing changes that shortened the voting-start delay to one hour are easier to understand against this: when the fix for stuck user funds has to clear a vote, every hour of mandatory delay is an hour those funds stay stuck.

Fixed first, explained later

June 2026 — Update LimitOrders on Starknet:

This update fixes a bug in the LimitOrders contract. It can only be fixed via a smart contract upgrade. No other contracts or features are affected. The details of the update will be shared after the proposal is executed.

The DAO was asked to approve a fix without being told what the bug was. That is the standard responsible-disclosure trade and it is genuinely uncomfortable in an on-chain governance system: proposals are public, and a detailed description of an unpatched vulnerability is a public description of how to exploit it. Voting on a fix you cannot fully evaluate is the cost of not broadcasting the vulnerability first.

It passed.

The recovery fund

June 15, 2026 — Contribute 300k USDC to the Recovery Fund, for users affected by the Huff Router approval incident of May 5, 2026.

The DAO transferred its Ethereum USDC-USDT position to Ekubo, Inc., which withdrew and swapped to acquire 300,000 USDC, returned the remaining position and residuals, and deployed a RecoveryFund contract for the users identified in the published incident report.

$300k is the second-largest single commitment in the archive, behind only the $1.5M Ekubo, Inc. services contract. It is also the third time the DAO has voluntarily made users whole — after the TWAMM refunds and the EVM v1 revenue refund. Three incidents, three votes to pay for them, none of them legally required. Whatever else the archive shows, that behaviour is consistent.

Closing the loop

July 27, 2026 — Upgrade Ekubo Starknet contracts to v5.0.3 and Governor to v2.8.0 upgraded every upgradeable Starknet contract at once and completed the protocol-fee migration described in Where the revenue goes: Core stops accruing protocol fees and clears its obsolete fee-rate slot, Positions applies a fixed 20% when position fees are collected, a new RevenueBuybacks instance sources from Positions, and Core ownership returns to the legacy RevenueBuybacks contract.

It is the most recent proposal in the archive, and it finishes work that started with the September 2024 decision to give Core a proxy owner. Twenty-three months from “make revenue withdrawable without a vote” to “revenue accrues where it should and flows automatically.”

The proposals

The whole archive, in one number

72 proposals between June 2024 and July 2026. 57 executed, 15 did not pass.

The failures are not spread evenly. Governance parameters: 6 for 6. Ethereum groundwork and audits: 5 for 5. Contract upgrades: 7 for 7. The DAO does not argue about plumbing.

It argues about spending. Incentives went 8 for 12. Contributor and marketing funding went 4 for 9. And six proposals passed on a second attempt after failing on a first — usually with the economics unchanged and only the framing, the calldata or the discussion link different.

That is a DAO that trusts its engineers and audits its cheques.