(a) Problem the project solves

Software is increasingly asked to operate physical assets it does not own. A rental platform, a fleet dispatcher, a lender, or an autonomous agent all need the same things from a vehicle: a verifiable identity, scoped permission from the owner, a way to confirm the vehicle's actual state, and in many cases the ability to operate it. Today each of those is rebuilt manufacturer by manufacturer, which is slow and expensive, and none of it is scoped to the length of a single use. DIMO provides identity, access, verification and, keys, as one permissioned interface across more than 50 brands. The owner grants the permission and can withdraw it, after which no new access is issued. Simply put, DIMO allows asset owners to get access to the revenue stream of the underlying asset and increase the value of their asset.

(b) Operational priorities

Network operations are funded by DCX revenue rather than by new token issuance. Developers buy DIMO Credits with DIMO and burn them on use. Sixty percent of that revenue goes to the protocol treasury and forty percent to node operators. Foundation spending runs against budgets approved by tokenholders under DIP-13, and treasury commitments require an approved DIP and 3-of-5 Safe execution. Digital Infrastructure Inc. builds and operates DIMO-facing products and services and funds itself from product revenue and corporate financing. It also contributes code to the protocol, mostly at it's own cost and according to its own business needs. DIMO Foundation may fund specific protocol work under a budget approved by token-holders. Baseline Issuance, which previously rewarded consumer-vehicle users under DIP-2, was discontinued under DIP-12.

(c) High-level project overview

DIMO is an open vehicle-data network and developer platform built around four primitives: identity, access, verification and keys. A vehicle owner connects a supported car or device and authorizes access. The vehicle is registered on DIMO Identity. The owner grants scoped permission to a named application, which exchanges that grant for a short-lived credential carrying only the access the session requires. Within that session the application can read telemetry, request signed attestations of facts such as VIN, odometer, location or vehicle health, and where supported operate the vehicle, including lock, unlock and charge control. The owner can withdraw the grant at any time, after which no further credentials are issued; a credential already issued runs to its expiry. Developers build rental, fleet, insurance, maintenance, charging and AI products on those interfaces. Digital Infrastructure Inc. develops DIMO-facing applications and contributes code to the open-source protocol. DIMO Foundation administers protocol IP, contracts, treasury resources, and specified smart-contract roles. Token-holders govern defined matters through DIMO Improvement Proposals.

(d) Primary token functions

The DIMO token has two primary functions. First, it carries delegated governance power: holders and delegates vote on token parameters, treasury budgets, core IP, Foundation governance, and other DIMO Improvement Proposals. Second, it is the only way to buy DIMO Credits (DCX), the network's access credit. DCX is non-transferable, fixed at $0.0001, and burned when spent. Developers pay 1,250 DCX per vehicle per month for data access, with historical lookback at 1,250 DCX per prior month up to 12,500 DCX. Sixty percent of DCX revenue goes to the protocol treasury and forty percent to node operators in proportion to the DCX burned on their behalf. Baseline Issuance rewards to connected-vehicle users, previously distributed under DIP-2, were discontinued under DIP-12 effective 2026-08-28. The undistributed allocation is frozen and cannot be reallocated without tokenholder approval. Governance can change these functions and parameters through the applicable proposal and voting process.

(e) Control surface reliance

Control is currently hybrid. Token holders vote on core policy through DIMO Improvement Proposals. DIMO Foundation multi-signature wallets and administrator roles implement approved changes, manage treasury resources, administer certain token, governance, registry, and upgrade functions, and may reject actions that are invalid or unlawful. The governance framework states an objective of moving more administration on-chain over time.

Labs / DevCo

Foundation

DAO / Onchain Governance

(a) IP ownership & control

The DIMO DAO is not a legal person and does not hold intellectual property in its own name. It controls protocol IP indirectly through DIMO Foundation, which is the DAO's legal representative and the sole director and shareholder of DIMO Limited; DIMO Limited owns the assigned protocol IP under the executed 2022-11-03 Asset Transfer Agreement.

The assigned IP comprises fifteen DIMO-Network code repositories — dimo-token; dimo-staking-license-contracts; dimo-identity; devices-api; device-data-api; users-api; rewards-api; nft-api; dimo-driver; dimo-explorer; meta-transaction-processor; cluster-helm-charts; DIP-internal; shared; and dimo — together with the DIMO and $DIMO trademarks and applications, the DIMO logo, the domains dimo.city, dimo.build, dimo.foundation, dimo.community, dimo.global, dimo.town, dimo.vin and dimo.eth, the DIMO documentation, and the proprietary BSL template. The same list is stated in Q4(b).

Licensing: DIMO Limited licensed the listed code to Digital Infrastructure Inc. on a perpetual, non-exclusive, worldwide, fully paid, royalty-free and sublicensable basis, with Digital Infrastructure Inc. owning the derivative works it creates, and licensed the DIMO mark to Digital Infrastructure Inc. on a fully paid, royalty-free, non-exclusive basis. Tokenholders control disposal of this IP through the DIP thresholds in Q4(c): a non-exclusive core-IP license requires Level 1, and a sale or disposal of core IP requires Level 3 (70% support, 10% quorum).

(b) Contract/admin powers

Roles and balances are as of 5 October 2026, after EIP-1 executed on Ethereum. Addresses are listed at the end.

Polygon. Since 29 September 2026 the Polygon DIMO token is administered only by the DIMO TimeLock, which holds the admin, minter and upgrader roles. The TimeLock executes only proposals passed through the DIMO Governor, after a 96-hour delay. No multisig or individual can mint, burn, upgrade or change roles on the token. The burner role is held by the TimeLock and by DimoCredit, whose code does not use it. The Polygon PoS ChildChainManager holds the depositor role and mints bridge deposits. The token is not paused.

A proposal needs 5,000,000 votes to submit, a quorum of 10% of Polygon DIMO and a majority of votes cast. Voting runs 268,800 blocks (about 4.7 days), then the proposal waits 96 hours in the TimeLock. The Governor is owned by the TimeLock, so its own rules change only by proposal. The DIP framework's Level 1 to 3 thresholds and 5% per-voter cap (Q4(c)) are process rules the contract does not enforce. A proposal to extend voting to about seven days and remove the TimeLock's minter role is planned.

Ethereum. The Ethereum DIMO token sets total supply. Since EIP-1 executed, the Ethereum TimeLock holds the admin and upgrader roles, the admin Safe holds the pauser role, and the Polygon PoS bridge predicate is the only minter; it releases DIMO to holders exiting Polygon. No Safe can mint, burn or upgrade Ethereum DIMO. The Ethereum Governor (5,000,000-vote proposal threshold, 5% quorum, 96-hour delay) is owned by its TimeLock. The token is not paused.

EIP-1 also burned 150,000,000 DIMO from the treasury under DIP-12 and returned 29,999,307.76 DIMO to the Polygon PoS bridge escrow, restoring the backing lost in the November 2025 bridge incident. Total supply is 848,893,318.64 DIMO.

Foundation pause and veto. The DIMO Foundation keeps two powers on both chains, exercised through the admin Safe: it can pause the token, and it can cancel a passed proposal during the 96-hour delay. That takes 3 of 5 signers on Polygon and 2 of 3 on Ethereum. The Safe cannot propose, schedule or execute anything, and holds no other role on either token. Tokenholders can remove either power by proposal, which the Safe can veto.

Treasury. The DIMO Limited treasury Safe (3 of 5 signers on both chains) holds 121,539,264.23 DIMO on Polygon and 100 DIMO on Ethereum. The admin Safe holds 18,361,523.24 DIMO on Polygon. Transfers do not go through the Governor, but under DIP-13 (effective 28 August 2026) discretionary spending requires a tokenholder-approved budget at Level 2 (60% support, 5% quorum) or above, covering at most twelve months and stating spending by category in USD and the maximum DIMO to be sold. Outside a budget, only pre-DIP-13 commitments, protocol rule-based payments such as the 40% node operator share under DIP-3, and an emergency allowance of up to US$1,000,000 per calendar year for security, legal or compliance matters are allowed. A treasury action clears the DIP vote and 96-hour timelock first, then the Safe's 3-of-5 threshold.

Other. The Developer License Admin Safe (2 of 5) holds DimoCredit's DC_ADMIN role, which sets DCX pricing inputs and the address that receives DIMO paid for DCX. It has no role on the token.

Method and threshold for each power.

• Mint, burn, upgrade or change roles on either token: passed proposal only. Majority of votes cast; quorum 10% on Polygon, 5% on Ethereum; 96-hour delay.
• Pause either token: admin Safe (PAUSER_ROLE). 3 of 5 on Polygon, 2 of 3 on Ethereum.
• Veto a passed proposal on either chain: admin Safe (CANCELLER_ROLE). 3 of 5 on Polygon, 2 of 3 on Ethereum.
• Treasury transfers: DIMO Limited treasury Safe, 3 of 5, after DIP approval and the 96-hour timelock.
• Bridge minting and burning: Polygon PoS ChildChainManager (DEPOSITOR_ROLE) and PoS bridge predicate (MINTER_ROLE), programmatic.

Contracts.

• DIMO token, Polygon: 0xE261D618a959aFfFd53168Cd07D12E37B26761db
• DIMO Governor, Polygon: 0xD203e37D96cC0b9b7Dc00fC3fDfcf1b1A2E8c547
• DIMO TimeLock, Polygon: 0x9F9859757b95100E2eC3d5E344608Dbe361dAaf4
• DimoCredit, Polygon: 0x7186F9aC35d24c9a4cf1E58a797c04DF1b334322
• PoS ChildChainManager, Polygon: 0xA6FA4fB5f76172d178d61B04b0ecd319C5d1C0aa
• DIMO token, Ethereum: 0x5fab9761d60419C9eeEbe3915A8FA1ed7e8d2E1B
• Governor, Ethereum: 0x80b5B0266E8f974758eaf65a06B69A7b953Ee91D
• TimeLock, Ethereum: 0x1AE34aBd6aF3B0E9168376137c546671675A766B
• PoS bridge predicate, Ethereum: 0x9923263fA127b3d1484cFD649df8f1831c2A74e4

Safes and signers. No Safe has a module or guard. Signers are identified by the letters A to H below. The treasury Safe and the Polygon admin Safe share the same five owners, three of whom are affiliated with Digital Infrastructure Inc.: Yevgeny Khessin, Diego Moro and Dylan Moreland (see Q5(d)).

• Admin Safe, Polygon, 3 of 5: 0xCED3c922200559128930180d3f0bfFd4d9f4F123. Signers A, B, C, D, E.
• Admin Safe, Ethereum (same address), 2 of 3. Signers A, D, E.
• DIMO Limited treasury Safe, Polygon and Ethereum, 3 of 5: 0xC97bF974d6D4bab6E0f7641B7b37eC5b70922cE5. Signers A, B, C, D, E.
• Ethereum DIMO Limited Safe, 3 of 5, no token roles since EIP-1: 0x1C618558C4d65fD7cfb65E81b65259183F444896. Signers B, C, D, E, F.
• Developer License Admin Safe, Polygon, 2 of 5: 0x62b98e019e0d3e4A1Ad8C786202e09017Bd995e1. Signers A, D, E, G, H.
• A (Dylan Moreland): 0x8d2B731Ccfffc2F7880231d94726c6c4FeD6F6A0
• B: 0x366b7Fb62795c21bF4d9329A93Ec707233166372
• C: 0x82f120a5CCc5E7dB1b7b79a534b3a08982A87296
• D: 0xB7BE3cde061ecB3a55a50A9854DcCfA8564663a9
• E: 0x55F5257Ca1Fdc5d0079db7317122DF73857b2fFD
• F: 0x3E54D4B54E41AeB81525b1d012dAac48B11b096e
• G: 0xf9D26323Ab49179A6d57C26515B01De018553787
• H: 0xa3bcc9701E360ddF642d6cf23eCB86ba9a95B3cf

(c) Locked-token rights (conditional)

A locking mechanism exists but confers no rights at present. Under DIP-2, DIMO could be locked in the staking contract 0xB4538A8D6AFab2849Ef78D08D49Dc1cc5AC2eD83 and attached to a vehicle at defined levels, contributing points toward that vehicle's weekly Baseline Issuance total. Baseline Issuance to connected-vehicle users was discontinued under DIP-12 effective 2026-08-28. Since that date a staked position earns nothing: the points it carries have no present effect, and no reward, fee, revenue or distribution attaches to it.

The contract remains open and positions are still being created. 10,332 stake positions existed as of 2026-09-17, in amounts of roughly 500 to 4,000 DIMO with terms running from six months to two years, after which the locked DIMO can be withdrawn. Locking does not alter the holder's DIMO balance or transfer rights beyond the lock term itself.

Locking has never conferred governance rights. DIP-1 voting rights are based on DIMO voting power and do not create a separate class of rights for locked tokens. Locked or staked tokenholders have no additional power to appoint directors, control treasury actions, pause or upgrade contracts, mint or burn tokens, or receive any separate economic distribution by reason of locking or staking.

(d) Current tokenholder governance rights and economic arrangements

Tokenholders vote on DIPs covering token parameters, treasury budgets, core IP, minting and burning, bylaws and director removal at the Level 1 to 3 thresholds in Q4(c). Proposals that change the Polygon token, its governance contracts or DimoCredit are voted and executed on-chain through the DIMO Governor and TimeLock described in Q3(b), subject to the Foundation's veto. Voting power is the holder's delegated DIMO balance on the chain where the proposal is made, so Polygon proposals count Polygon DIMO and Ethereum proposals count Ethereum DIMO; a holder must delegate, which it can do to itself, before it can vote. Baseline protocol rewards were distributed to eligible connected-vehicle users under DIP-2 based on network participation. That program was discontinued under DIP-12 effective 2026-08-28, and the undistributed allocation is frozen and cannot be reallocated without tokenholder approval. Network revenue is now generated through DCX (DIMO Credits), which developers buy with DIMO; the credits, not the DIMO, are burned on use. That revenue is split sixty percent to the protocol treasury and forty percent to node operators. Neither mechanism creates a pro-rata claim for tokenholders: holding, locking, delegating or voting DIMO does not entitle a holder to protocol fees, revenue or rewards. No buyback or treasury sale program is currently operative outside a DIP-13 budget.

(e) Control surface reliance

Most contract administration has moved on-chain. Since 2026-09-29, minting, burning, upgrades and role changes on the Polygon DIMO token, and upgrades of the Governor, TimeLock and DimoCredit, execute only through a passed on-chain proposal after the 96-hour TimeLock delay. Since EIP-1 executed, the Ethereum token follows the same model. DIMO Foundation keeps, by design, a pause switch and a veto over queued proposals on both chains, exercised through its admin Safe. Because the same Safe holds both, it could pause the token and cancel any proposal to remove either power; tokenholders cannot override the veto on-chain.

Execution is not fully autonomous. Treasury transfers depend on the Foundation's 3-of-5 treasury Safe after DIP approval, and DIP-13 limits discretionary spending to tokenholder-approved budgets. A proposal to extend on-chain voting to about seven days and to remove the TimeLock's minting role is planned.

(f) Dissolution authority

The DIMO DAO has no separate onchain dissolution authority or DAO-specific dissolution vote. The applicable legal wind-up mechanism is in the DIMO Foundation Bylaws dated 2022-12-16, read with the Foundation's current certified corporate records. DIMO Foundation's board is the approval body: it approves winding-up by a majority vote with a quorum of two directors when more than one director is in office, or by a written resolution signed by all directors. The Supervisor then effects the process by delivering notice to the Foundation's registered office with the approving board minutes or written resolution attached. The liquidator is the person designated in that notice; if none is designated, the directors or their appointee serve. Members, directors, and the Supervisor, solely in those capacities, may not petition to wind up the Foundation except for insolvency or a bona fide reorganization. No tokenholder vote is independently required by the reviewed bylaws for the legal wind-up step.

(a) Entity

DIMO Foundation is an exempted limited foundation company limited by guarantee and not having a share capital, incorporated in the Cayman Islands under the Companies Act and Foundation Companies Act on 2022-10-04, registration CB-394409. It represents the DIMO DAO in legal, contractual, and regulatory processes. A certified register of directors printed 2025-09-05 lists Oliver Tuke Bell and Petrus Dorfling Basson as directors. DIMO Foundation is also the sole director and sole shareholder of DIMO Limited, a separate BVI business company.

(b) IP ownership & control

DIMO Foundation itself did not receive the assigned assets. Under the executed 2022-11-03 Asset Transfer Agreement, DIMO Limited owns the protocol IP and the Foundation controls it indirectly as DIMO Limited's sole director and shareholder. The assigned IP includes 15 DIMO-Network repositories: dimo-token; dimo-staking-license-contracts; dimo-identity; devices-api; device-data-api; users-api; rewards-api; nft-api; dimo-driver; dimo-explorer; meta-transaction-processor; cluster-helm-charts; DIP-internal; shared; and dimo. It also includes the DIMO and $DIMO marks and applications, the DIMO logo, dimo.city, dimo.build, dimo.foundation, dimo.community, dimo.global, dimo.town, dimo.vin, dimo.eth, DIMO documentation, and the proprietary BSL template. DIMO Limited licensed the DIMO mark to DINC for a 12-month transition and licensed the listed code perpetually on a non-exclusive, worldwide, fully paid, royalty-free, sublicensable basis; DINC owns derivative works it creates.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

DIMO Foundation exists. It cannot initiate changes to governance, supply, issuance, rewards or core IP. Its admin Safe can pause DIMO and veto passed proposals. DIP sponsorship requires 5,000,000 DIMO support; voting lasts 7 days, has a 96-hour timelock, and caps one voter at 5%. Level 1 requires more than 50% support and 3% quorum for treasury commitments below 5,000,000 DIMO and non-exclusive core-IP licenses. Level 2 requires 60% support and 5% quorum for 5,000,000-15,000,000 DIMO commitments, bylaw changes, and director removal. Level 3 requires 70% support and 10% quorum for minting or burning, governance or issuance changes, reward-parameter changes, core-IP sale or disposal, and treasury commitments above 15,000,000 DIMO.

Token administration on Polygon, including minting, burning, upgrades and role changes, executes only through the on-chain DIMO Governor and its 96-hour TimeLock. The Governor enforces a 5,000,000-vote proposal threshold, a 10% quorum and a simple majority, with voting currently running about 4.7 days; the Level support thresholds and the per-voter cap are not enforced by the contract. Ethereum follows the same model since EIP-1 executed. The Foundation's remaining contract powers on governed chains are to pause the token and to veto a queued proposal, exercised through its admin Safe 0xCED3c922200559128930180d3f0bfFd4d9f4F123 (3 of 5 on Polygon, 2 of 3 on Ethereum). The Developer License Admin Safe 0x62b98e019e0d3e4A1Ad8C786202e09017Bd995e1 (2 of 5), a multisig held by the five signers listed in Q3(b), holds DC_ADMIN on DimoCredit. It sets DCX pricing and the DIMO receiving address without a DIP vote.

Approved treasury commitments are executed by the DIMO Limited treasury Safe 0xC97bF974d6D4bab6E0f7641B7b37eC5b70922cE5, which requires 3 of 5 owners. DIP-13 eliminated the standing authority granted by DIP-6 Amendment 1 to sell treasury DIMO and to loan or provide DIMO to market makers without per-sale approval. Discretionary Foundation spending now requires a budget approved by tokenholders at Level 2 or above, covering no more than twelve months and stating planned spending by category in USD equivalent and the maximum DIMO to be sold. Spending outside an approved budget is permitted only for binding commitments made before DIP-13, for protocol rule-based payments such as the forty percent node-operator share under DIP-3, and for an emergency allowance of up to US$1,000,000 equivalent per calendar year for security, legal or compliance matters. A transition period of up to 180 days applies at the trailing twelve-month average monthly run rate, after which discretionary spending pauses without an approved budget. Corporate board action separately requires a director majority with quorum of two, or a written resolution signed by all directors.

(d) Powers over DevCo

DIMO Foundation exists. It has no direct equity ownership or corporate governance authority over Digital Infrastructure Inc. (DINC), the Primary DevCo. DINC is a separate Delaware corporation, and the 2022 asset transfer was intended to make the protocol assets independent from DINC.

The Foundation has no indirect influence over DINC. It holds no DINC equity, board seat or contractual right. It may fund specific work only under a tokenholder-approved budget.

(e) Contract/admin powers

DIMO Foundation exists. Its contract powers are limited to a pause switch and a veto on Polygon and Ethereum.

On Polygon, the DIMO Limited admin Safe 0xCED3c922200559128930180d3f0bfFd4d9f4F123 (3 of 5) holds PAUSER_ROLE on DIMO token 0xE261D618a959aFfFd53168Cd07D12E37B26761db and the CANCELLER_ROLE on the DIMO TimeLock 0x9F9859757b95100E2eC3d5E344608Dbe361dAaf4, which lets it cancel any passed proposal during the 96-hour delay. It holds no admin, mint, burn or upgrade role on the token and cannot propose or execute governance actions. A pause would halt transfers of the Polygon token. The token is not paused.

On Ethereum, since EIP-1 executed, the admin Safe 0xCED3c922200559128930180d3f0bfFd4d9f4F123 (2 of 3) holds PAUSER_ROLE on DIMO token 0x5fab9761d60419C9eeEbe3915A8FA1ed7e8d2E1B and the veto on the Ethereum TimeLock. The Ethereum TimeLock holds DEFAULT_ADMIN_ROLE and UPGRADER_ROLE and owns the Ethereum Governor. The Ethereum DIMO Limited Safe 0x1C618558C4d65fD7cfb65E81b65259183F444896 holds no token role. No Safe can mint, burn or upgrade Ethereum DIMO.

Treasury transfers are executed by the DIMO Limited treasury Safe 0xC97bF974d6D4bab6E0f7641B7b37eC5b70922cE5, which requires 3 of 5 owners, after the applicable DIP approval and 96-hour timelock. Role holders and signers are itemised in Q3(b).

(f) Current economic arrangements and distribution policies

Current mechanisms are as follows. DIMO Limited holds the token treasury in Safe 0xC97bF974d6D4bab6E0f7641B7b37eC5b70922cE5 on Polygon and Ethereum. Under DIP-13, effective 2026-08-28, discretionary spending from it requires a budget approved by tokenholders at Level 2 (60% support, 5% quorum) or above, with the exceptions and transition period described in (c), and 3-of-5 Safe execution. Under DIP-12, 150,000,000 treasury DIMO was burned when EIP-1 executed, as described in Q3(b). Network revenue is generated through DCX under DIP-3: developers purchase DCX with DIMO, and the DCX, not the DIMO, is burned on use, at 1,250 DCX per vehicle per month with historical lookback at 1,250 DCX per prior month up to 12,500 DCX. Sixty percent of that revenue is retained by the protocol and forty percent is distributed to node operators in proportion to DCX burned on their behalf. Baseline Issuance to connected-vehicle users under DIP-2 was discontinued under DIP-12 effective 2026-08-28, and the undistributed allocation is frozen. The Ignite grants program established under DIP-8 is not operating, and no distributions are being made under it. Digital Infrastructure Inc. contributes code largely at its own cost and participates on the same terms as any other builder; the Foundation may pay it for specific protocol work under an approved budget. DIMO Foundation has no share capital or equityholders, and no protocol-fee, revenue-share, dividend or profit-distribution mechanism to the Foundation, its directors, contributors or tokenholders exists beyond the mechanisms stated above.

(a) Entity

Digital Infrastructure Inc. is the primary DevCo. It is a Delaware corporation. Its restated certificate of incorporation was filed with the State of Delaware on June 17, 2021.

(b) IP ownership & control

Digital Infrastructure Inc. does not own the core protocol intellectual property assigned on 2022-11-03; DIMO Limited, wholly owned by DIMO Foundation, owns it. Digital Infrastructure Inc. holds a full license to use it. The code license covers the fifteen DIMO-Network repositories — dimo-token; dimo-staking-license-contracts; dimo-identity; devices-api; device-data-api; users-api; rewards-api; nft-api; dimo-driver; dimo-explorer; meta-transaction-processor; cluster-helm-charts; DIP-internal; shared; and dimo — and is perpetual, non-exclusive, worldwide, fully paid, royalty-free and sublicensable.

Digital Infrastructure Inc. builds and operates its own commercial products and services on that licensed codebase, including DIMO Mobile and its related web and developer products, and owns the derivative works it creates. It also contributes code back to the open-source repositories.

Digital Infrastructure Inc. received a fully paid, royalty-free, non-exclusive twelve-month transitional license to use the DIMO marks. The 2022 assignment does not give it ownership of the DIMO marks, the logo, the listed domains, DIMO documentation, or the proprietary BSL template.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

Digital Infrastructure Inc. exists. It has no DAO vote, treasury authority, token-administration authority, protocol-controlled-resource authority, reward-parameter authority, or related approval threshold. Under the Shared Services Agreement, terminated with effect from 2026-08-24, it provided protocol advisory and R&D, administrative support, hosting of protocol data and user applications, marketing, raw and processed user data, the dimo.zone redirect, and Discord operation. It now contributes code to the DIMO open-source repositories, largely at its own cost and according to its own business needs. DIMO Foundation may pay for specific work the protocol requires under a budget approved by tokenholders. That contribution carries no governance authority of any kind and confers no approval threshold.

(d) Powers over Foundation

Digital Infrastructure Inc. exists. It has no direct corporate authority over DIMO Foundation or DAO decisions: no verified ownership interest, board appointment right, treasury authority, or governance vote over the Foundation. Its influence on protocol work is advisory and operational only, through code contributions and recommendations. Each entity's management remains vested solely in its own board, and neither party may generally bind the other.

Digital Infrastructure Inc. does, however, have indirect influence through signer overlap. Three of the five owners of the DIMO Limited treasury Safe are affiliated with Digital Infrastructure Inc.: Yevgeny Khessin (CEO), Diego Moro (Finance) and Dylan Moreland (Infrastructure Engineer). The Polygon admin Safe, which holds the pause and veto powers, has the same five owners. Both Safes require 3 of 5 signatures, so these three signers can together meet either threshold.

(e) Contract/admin powers

Digital Infrastructure Inc. (DINC) holds no contract or administrator power over the DIMO token or DAO-controlled contracts. As an entity, DINC has no pause authority, upgrade authority, governance-executor authority, mint or burn authority, treasury authority, or reward-parameter authority, and therefore no applicable contract, account, approval method or threshold for those powers in its own name. The Shared Services Agreement terminated 2026-08-24. Token administration on Polygon and Ethereum is executed on-chain by each chain's DIMO Governor and TimeLock; Foundation-controlled Safes hold the pause and veto powers and execute treasury transfers, as itemised in Q3(b).

Three DINC-affiliated individuals, Yevgeny Khessin, Diego Moro and Dylan Moreland, are among the five owners of the treasury Safe and the Polygon admin Safe, enough to meet their 3-of-5 thresholds. That overlap is disclosed in Q5(d) as indirect influence.

(f) Current economic arrangements and distribution policies

Digital Infrastructure Inc. contributes code to the DIMO open-source repositories, largely at its own cost and according to its own business needs. Under DIP-13 it receives no grants, subsidies, investments or guaranteed contracts from DIMO Foundation, and participates on the same terms as any other builder. DIMO Foundation may pay for specific work the protocol requires, under a budget approved by tokenholders. Digital Infrastructure Inc. retains the perpetual, non-exclusive, worldwide, fully paid, royalty-free and sublicensable code licenses granted in 2022 and owns derivative works it creates. It has no token, treasury, equityholder, reward, fee-revenue or token-distribution entitlement.

The initial airdrop was executed beginning at the December 2022 mainnet launch. The final allocation source, updated 2023-05-08, totals 67,667,245.0262509 DIMO across AutoPi hardware, software-connected vehicle, and referral allocations. Public per-address source: https://docs.google.com/spreadsheets/d/1hvLvptxufb76OZ8Dxjt3BUnhNakPdUF2RobkYZEzBUE/edit . The public sheet contains 2,773 allocation records with segment, allocation status, wallet address, source-record count, allocated DIMO, sent DIMO, due DIMO, remaining DIMO, as-of date, and source sheet. It contains no emails, names, VINs, user IDs, order numbers, or device IDs. Three source populations that did not have a valid recipient wallet are shown only as segment-level unassigned aggregate rows. Covered segments were 4,025 AutoPi devices and 2,626 software-connected vehicles, plus eligible referrers. One activity point equaled 0.019196184456684907 DIMO; each qualifying device received a 4,878.232110643416 DIMO base allocation; AutoPi users also received 9,000 points per qualifying week; software users received points plus the device base; and each eligible referral received 100 DIMO. Eligibility required a linked Ethereum address, a qualifying hardware or software vehicle connection, and blacklist review.

(a) Date & component affected

2025-11-06. Ethereum bridge proxy 0x07C64bd1B23b7C9B0ABf80b8613f58e5B00ED5dD and the custody of DIMO held by that bridge were affected. The verified transfer occurred at 18:29:47 UTC.

(b) Exploit vector summary

Public incident reporting attributes the event to compromise of a developer or administrator key. The attacker used that authority to upgrade the bridge proxy to a malicious implementation and withdraw DIMO held by the bridge.

(c) Quantified impact

The incident transferred 29,999,307.76362104 DIMO from the Ethereum bridge proxy to an attacker-controlled address, approximately 3.0% of the 1,000,000,000 DIMO total supply. The affected asset was DIMO held in bridge custody. No verified USD value at the time of loss was located. The evidence reviewed does not show a change to the core DIMO token's authorized total supply, minting rules, or balances outside the stolen bridge custody.

(d) Remediation/response taken

Completed response actions: the malicious bridge implementation was reported replaced approximately one hour after the incident, and administrative ownership was moved to the 3-of-5 Polygon DIMO Limited Safe at 0xCED3c922200559128930180d3f0bfFd4d9f4F123.

(e) Current status

Status as of 9/14/2026 not resolved. The stolen DIMO has not been recovered and no compensation has been paid to affected parties. The incident has been reported to United States federal authorities and no further update has been received. The on-chain transfer is confirmed. The malicious bridge implementation was replaced and administrative ownership was moved to a 3-of-5 multisignature Safe. The core DIMO token contract, the broader network, user accounts, user assets and user data were not affected by this incident.

(f) References

Official DIMO Network incident advisory / public statement: https://x.com/DIMO_Network/status/1986847282889957391

(a) Regulatory, Legal & Tax Risks

Digital-asset laws may change or conflict across jurisdictions and may affect token trading, exchange availability, treasury sales, governance participation, rewards, liquidity programs, and delivery of tokens under any existing agreement. DIMO Foundation, DINC, service providers, and market participants may face licensing, registration, enforcement, sanctions, KYC, consumer-protection, tax, or restructuring requirements. Vehicle, identity, telemetry, and location data create privacy, consent, cybersecurity, retention, and cross-border transfer obligations, including under GDPR and the EU Data Act. Tax treatment of rewards, sales, governance activity, and gains may differ by holder and jurisdiction. Each tokenholder is responsible for obtaining advice about their own tax obligations. Jurisdiction and user-access restrictions may reduce participation or liquidity

(b) Protocol, Technology & Security Risks

Smart contracts, administrator keys, multisignature wallets, bridges, custody providers, upgrade mechanisms, registries, oracles, vehicle devices, OEM and third-party APIs, and open-source dependencies may fail or be compromised. The November 2025 bridge incident demonstrates privileged-access and bridge risk. Vehicle data can be incomplete, delayed, inaccurate, spoofed, or unavailable, and an owner or vehicle manufacturer may revoke or restrict access. Code defects, network congestion, cross-chain inconsistencies, loss of key personnel, or service-provider failure may interrupt protocol operations or cause loss of tokens. Audits and access controls reduce but do not eliminate these risks.

(c) Token Economics, Unlocks & Incentive Risks

DIMO price and liquidity may be volatile. Treasury sales, market-making or exchange arrangements, contributor and capital-partner unlocks, concentrated holdings, low governance participation, or limited trading venues may affect market integrity and decentralization. Baseline rewards decline 15% each year, which may weaken participation incentives or require governance changes. Governance and Foundation authorities can change issuance, allocations, contracts, treasury use, and other token parameters subject to voting and legal constraints. Large holders, delegates, Foundation administrators, DINC, or other service providers may exert substantial practical influence even where formal voting caps apply. Rewards may not offset users’ hardware, connectivity, tax, or opportunity costs, and incentive design may attract low-quality or manipulated data.