Ekubo Protocol is a community-source automated market maker with concentrated liquidity on Ethereum, Starknet and other EVM chains. Its permissionless extension system supports features including on-chain oracles, DCA orders and liquidity incentives. Since July 2026 it also includes Ve33, an extension through which locked stake tokens direct liquidity incentives and pool swap fees. The first deployment, STONX (Ekubo Stock Liquidity Token), launched on Robinhood Chain on July 31, 2026. STONX is separate from EKUBO and does not confer rights in Ekubo DAO governance. Information is current as of 29 September 2026; H2 2026 is not yet complete.

Labs / DevCo

Foundation

DAO / Onchain Governance

(a) IP ownership & control

Public code and repository-specific licences are available at https://github.com/EkuboProtocol/. Ekubo, Inc., a Delaware corporation, is the named licensor of the EVM code under the Ekubo DAO Shared Revenue License 1.0 (https://ekubo-license-v1.eth.link/). The DAO is a third-party beneficiary of the licence: third-party licensees owe 50% of their defined Protocol Revenue to the DAO, subject to the licence terms. Governance may clarify the revenue definition, set the payment address and reduce the share. These contractual rights are distinct from ownership of copyright or automatic on-chain fee routing.

As confirmed by the issuer on October 2, 2026, we, Ekubo, Inc., identify ourselves as the copyright holder of the Ekubo codebase, rather than the DAO. This issuer statement is corroborated by reviewed repository copyright notices; it is not independent verification of every contributor assignment or the complete chain of title. Repository licences differ. The DAO's beneficiary and licence-governance rights are separate from copyright ownership.

At Ethereum block 26,105,558 (October 2, 2026 15:32:59 UTC), the ENS licence name ekubo-license-v1.eth is registered to the DAO's Ethereum governance proxy 0x1E0EF4162e42C9bF820c307218c4E41cCcA6E9CC until September 30, 2035. Its records are controlled by the separate address 0xF94E5Cdf41247E268d4847C30A0DC2893B33e85d, also the sole owner address of the company Ethereum Safe. The registrant can replace that controller through governance. The identity of the controller's key custodian remains unconfirmed; DAO registration does not identify that separate custodian. The controller has the additional-signer authority described in item 11, not verified single-key-only authority.

Ekubo, Inc.'s U.S. EKUBO standard-character trademark application 50039549 was filed August 8, 2026 and is pending examination, not registered. Earlier application 98742533 is abandoned. These are U.S. records; no worldwide registration claim is made.

(b) Contract/admin powers

The Starknet Governor requires 100,000 EKUBO of average delegated voting weight to propose, a one-hour pre-vote delay, a four-day vote, at least 3,250,000 EKUBO in favour and more votes in favour than against, then a one-hour execution delay. The execution window is 30 days. It executes passed proposals directly; there is no separate guardian or veto role. Governance can reconfigure or upgrade the Governor by proposal and has exercised upgrade authority over Starknet protocol contracts. The absence of a dedicated pause function in published source does not prevent an upgrade from changing or disabling behaviour.

EVM Core contracts are immutable and ownerless. Peripheral manager ownership differs by chain and generation. The original Ethereum Positions contract is owned by RevenueBuybacks under DAO governance. Ekubo, Inc.'s development key owns the other deployed Positions and Orders managers in the reviewed deployment matrix: original Orders and v3.2 Positions/Orders on Ethereum; both generations on Arbitrum, Base, Monad and MegaETH; original managers on Robinhood Chain; v3.2 managers on Optimism, BNB Smart Chain, Gnosis, Unichain, World Chain and Ink; and v3.2 Positions on Polygon. No v3.2 Orders code was found at its expected Polygon address.

A Positions owner can withdraw accrued protocol fees and set NFT metadata. An Orders owner can set NFT metadata but cannot withdraw funds. Both can transfer or renounce ownership. These owner roles do not permit pausing, upgrading or moving users' positions or orders. The separate Ve33Positions contract has a metadata-only owner role held by the DAO's Robinhood Chain proxy.

Governance also controls STONX minting through the Starknet Governor → Ethereum L1 proxy → Robinhood Chain owner proxy. STONX minting has no supply cap other than its contract's uint128 bound. This authority is unrelated to EKUBO's fixed supply. Method of authority for the company development address 0x00000C771F6176268D5A9846E0956C3eF58597A1 varies by chain. At the September 29 Ethereum cutoff it was EIP-7702 delegated to AmbireAccount7702 (0x5a7fc11397e9a8ad41bf10bf13f22b0a63f96f6d), with only its original private key privileged. On Robinhood Chain a September 29 17:03:40 UTC transaction installed Alchemy SemiModularAccount7702 (0x69007702764179f14f51cdce752f4f775d74e139) and a global additional signer 0x184a439f5b87336bf73da844de1814abd11c760a; a September 30 20:48:58 UTC state read shows that either original key or additional signer can act alone, with no joint-signature threshold. On October 1, 2026 the issuer stated that it does not recognize the additional signer; its custody is unknown. September 30 reads show Ambire delegation on MegaETH and plain single-key EOAs on Arbitrum, Base, Optimism, BNB Smart Chain, Gnosis, Unichain, World Chain, Ink and Monad.

On Polygon PoS (chain ID 137), development address 0x00000C771F6176268D5A9846E0956C3eF58597A1 is a plain externally owned account with no contract code or EIP-7702 delegation at block 94,680,839 (September 29, 2026 23:59:59 UTC) and block 94,888,708 (October 3, 2026 14:36:42 UTC). Its nonce was 27 at both blocks, supporting no delegation set or cleared between them. No implementation contract or additional contract-configured signer applies on Polygon; its onchain authority is the account private key.

Clarification following reviewer feedback: independently checked module reads confirm the installed additional signer on Robinhood Chain and on the company Ethereum Safe-owner address. The installations were self-submitted by the original account keys. Unknown signer custody does not remove that authority; we cannot accurately describe the development address as a single-key EOA on every chain. No malicious-control finding is made. The Safe approveHash route remains source-inferred, not simulated.

(c) Locked-token rights (conditional)

EKUBO holders stake on Starknet to vote or delegate; staking has no minimum lock or withdrawal delay and does not automatically pay rewards. Separately, STONX holders on Robinhood Chain may lock for up to four years, without early withdrawal, to direct emission allocation among pools and participate in setting those pools' swap fees. The locks are transferable NFTs and can be increased, extended, split or merged. STONX voters do not acquire arbitrary proposal-execution, upgrade or minting powers. STONX confers no Ekubo DAO governance rights, and EKUBO confers no STONX voting rights.

(d) Current tokenholder governance rights and economic arrangements

Passed EKUBO proposals authorize on-chain execution by the Governor, including treasury actions and the contract powers above. An off-chain request that Ekubo, Inc. perform additional services is distinct from on-chain execution; the company may decline additional responsibilities. Protocol fees collected through the established Starknet and original Ethereum Positions paths fund EKUBO buybacks. Bought-back tokens are not irrevocably burned and may be used under governance control. EKUBO staking does not itself guarantee distributions.

In Ve33 pools all swap fees are routed to STONX lockers voting for those pools, not to the DAO. The DAO can earn incentives on its own STONX/USDG liquidity position. Licence obligations of third-party licensees are separate from these contract flows. The licence contains no express Ve33 exclusion; it also does not establish an obligation of Ekubo, Inc., as licensor, to remit its own locker receipts. No claim that the DAO owns all protocol-related revenue is made.

(e) Control surface reliance

Starknet operation relies on governance-controlled upgradeable contracts; EVM Core and Ve33 logic are immutable. Peripheral owner keys and cross-chain governance proxies remain relevant control surfaces. As confirmed by the issuer on September 30, 2026, Ekubo, Inc. plans to transfer ownership of the Positions and Orders contracts to the Ekubo DAO on all chains where those contracts are deployed, as soon as a proxy contract is available on the relevant chain to confer ownership to the Starknet-based governance contracts. No calendar completion date has been specified. This is a planned change, not a statement that the transfers have occurred; current ownership is described in item 3(b).

(f) Dissolution authority

The reviewed governance contracts have no dedicated dissolution function. Passed proposals can transfer treasury assets and exercise the Governor's ownership and upgrade powers, subject to the applicable contract paths. This describes technical authority, not a determination of the DAO's legal domicile or any exclusive statutory wind-up process.

(a) Entity

No primary foundation exists; no foundation entity type or jurisdiction applies.

(b) IP ownership & control

No primary foundation exists; no foundation IP ownership or subsidiary structure applies.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

No primary foundation exists; no foundation DAO, treasury, token-administration or reward authority applies.

(d) Powers over DevCo

No primary foundation exists; no foundation influence over the DevCo applies.

(e) Contract/admin powers

No primary foundation exists; no foundation contract, pause, upgrade or executor authority applies.

(f) Current economic arrangements and distribution policies

No primary foundation exists; no foundation economic arrangement or distribution policy applies.

(a) Entity

Ekubo, Inc., a Delaware corporation, is the primary developer company.

(b) IP ownership & control

As confirmed by the issuer on October 2, 2026, we, Ekubo, Inc., identify ourselves as the copyright holder of the Ekubo codebase. Reviewed repository copyright notices corroborate this issuer assertion; an exhaustive contributor-assignment chain of title has not been independently established. Licence types differ, including MIT, the EVM shared-revenue licence, the Starknet permissions-based licence and LGPL for the Rust SDK. The DAO's licence-beneficiary and governance rights are separate from copyright ownership. We are the named EVM-code licensor and the applicant for the pending U.S. EKUBO trademark application described in item 3(a). No IP-holding subsidiary is identified in the reviewed issuer records.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

At Starknet block 15,651,978 (September 29, 2026 23:59:57 UTC), the identified current company wallet had 3,233,333.333333985118997471 EKUBO staked: 2,133,333.333333985118997471 delegated to itself and 1,100,000 delegated outward in eleven equal 100,000 allocations to community delegates. Inbound delegation from 67 other addresses was 8,110.112097240655442945 EKUBO; its delegated weight was 2,141,443.445431225774440416. The historically identified former company wallet held no own stake but carried 163,953.259859567921411264 EKUBO delegated by 1,769 other addresses. On October 1, 2026 the issuer confirmed that the former wallet is an Argent web wallet controlled by Ekubo, Inc. and stated that there is no known affiliation of inbound delegators with the company. This is an issuer statement about known affiliation, not independent identification of every delegator. Identified company-owned stake alone is below the 3,250,000 approval minimum even if fully self-delegated. This does not mean the company cannot obtain sufficient voting authority: combining fully re-delegated own stake with both wallets' inbound support would exceed the minimum if that support and control are retained. Each proposal uses average delegated weight during the 24 hours before voting opens, and requires yea at least 3,250,000 and yea greater than nay; cutoff balances are not every proposal's weight. Treasury: the company has no independent treasury power beyond token voting and the temporary proposal-directed asset transfers described in item 5(e). Token administration: none for EKUBO, which has fixed supply and no token admin role. Positions ownership gives the company power to withdraw accrued protocol fees as described in 5(e), separately from treasury governance.

On September 8, 2026 at 18:00:54 UTC, we relinquished the initial 333,333 STONX allocation by transferring the lock NFT holding it to 0x000000000000000000000000000000000000dEaD, transaction https://robinhoodchain.blockscout.com/tx/0xc1fef8a1e40bbcd3726eee382658ee9435c85e085e21c7e03eaccb2a4d0b51a4. This was transfer of the vote-escrow NFT, not an ERC-20 supply burn: the STONX remain locked and the position has no applied vote or approval. Under the reviewed VeToken source, owner/approved authority is required to vote, claim fees or withdraw. The dead-address lock cannot exercise those rights. EVM source semantics were reviewed, not bytecode-matched in this reconstruction.

At September 29, 2026 23:59:59 UTC (Robinhood Chain block 76,069,815), the identified company development address held 54,817.209063840282496541 locked STONX out of 460,005.612254679926500289 total locked: 11.92% including the relinquished 333,333 position, or 43.27% of 126,672.612254679926500289 locked STONX excluding it. Its applied vote weight was 54,817.209063840282496541 out of 123,934.212077331652101793, or 44.23%. Applied vote weight is distinct from time-decayed potential voting power. Historical figures are event-reconstructed and reconciled to later live stake reads because the RPC did not serve historical state; attribution covers the development address, not an exhaustive search for other company-controlled locks. Later receipts mean company ownership is not zero. Ekubo, Inc. directs Ve33 emissions and pool fees by lock-weighted STONX vote, subject to its voting share, and receives fees on pools it votes for. It holds no STONX mint authority.

The July 2 filing described abstention on additional-token launch proposals and no interface fees. We voted in favour of the July 21, 2026 STONX launch-capital proposal using both identified company wallets. That proposal funded launch capital rather than directly minting tokens. We do not recertify blanket current token-launch abstention; the old undertaking's current scope and the continued operation of other historical undertakings are unconfirmed. No replacement promise is made.

(d) Powers over Foundation

Not applicable: no primary foundation exists.

(e) Contract/admin powers

Ekubo, Inc.'s development key holds the chain/version-specific Positions and Orders owner roles in item 3(b). Positions ownership permits protocol-fee withdrawals and NFT metadata changes; Orders ownership permits metadata changes only. These roles do not permit upgrades, pauses or access to user positions. Governance may also transfer assets to the company temporarily to perform an authorized operational action. Method of authority for the company development address 0x00000C771F6176268D5A9846E0956C3eF58597A1 varies by chain. At the September 29 Ethereum cutoff it was EIP-7702 delegated to AmbireAccount7702 (0x5a7fc11397e9a8ad41bf10bf13f22b0a63f96f6d), with only its original private key privileged. On Robinhood Chain a September 29 17:03:40 UTC transaction installed Alchemy SemiModularAccount7702 (0x69007702764179f14f51cdce752f4f775d74e139) and a global additional signer 0x184a439f5b87336bf73da844de1814abd11c760a; a September 30 20:48:58 UTC state read shows that either original key or additional signer can act alone, with no joint-signature threshold. On October 1, 2026 the issuer stated that it does not recognize the additional signer; its custody is unknown. September 30 reads show Ambire delegation on MegaETH and plain single-key EOAs on Arbitrum, Base, Optimism, BNB Smart Chain, Gnosis, Unichain, World Chain, Ink and Monad.

On Polygon PoS (chain ID 137), development address 0x00000C771F6176268D5A9846E0956C3eF58597A1 is a plain externally owned account with no contract code or EIP-7702 delegation at block 94,680,839 (September 29, 2026 23:59:59 UTC) and block 94,888,708 (October 3, 2026 14:36:42 UTC). Its nonce was 27 at both blocks, supporting no delegation set or cleared between them. No implementation contract or additional contract-configured signer applies on Polygon; its onchain authority is the account private key. The development address also relays DAO funds operationally: on September 20 it received 15,381.290500925224 EKUBO from the DAO L1 proxy and bridged that amount to Starknet nine minutes later. Relayed DAO funds are not company revenue or ownership.

Ekubo, Inc. holds no pause, upgrade or governance-executor authority and no guardian or veto role in the reviewed protocol/governance contracts. Company voting participation is distinct from those administrative roles. Proposal-directed temporary custody of DAO position NFTs occurred June 21, July 26 and September 20, 2026. The USDC/USDT position was returned in each episode; the July ETH/USDT position remains at the development address with zero liquidity at the October 2 read. These transfers are not a standing right to the DAO treasury.

(f) Current economic arrangements and distribution policies

The DAO approved a grant described as $1.5 million for two years of services, executed July 28, 2024, comprising 180 ETH, 560,000 STRK and 600,000 USDC.e. This was historical funding; the service period has elapsed. No DAO grant to Ekubo, Inc. is currently in force, and no side letter directs DAO resources to it. As confirmed by the founder on October 3, 2026, there are no side letters or offchain agreements related to the DAO from Ekubo, Inc. This does not establish that company reserves are exhausted. The company holds token reserves and receives Ve33 voter fees through its STONX locks. These receipts are distinct from EKUBO staking and from the earlier service grant. Company resources support development, security and operations. Corporate equity rights are separate from EKUBO token rights. In our July 2, 2026 filing, we stated that company-generated revenue is not distributed to EKUBO holders, that we would not earn revenue in a way that hinders protocol revenue, and that no agreements with team members or investors commit the company team allocation. The current operative scope of those historical statements was not reconfirmed in this update; they are not newly adopted commitments or automatic token-contract entitlements. The 100,000 EKUBO company-funded liquidity-support authorization in item 14 is disclosed separately. From deployment through September 29, 2026, Ekubo, Inc. withdrew no protocol fees from EVM Positions contracts: zero withdrawals, hence no amounts retained or remitted. Accrued fees remain unwithdrawn and are not receipts. The review covered all 18 deployed Positions chain/contract pairs, distinguishing the original Ethereum contract DAO-owned RevenueBuybacks path: its 283 withdrawal calls in 51 transactions paid the DAO buyback contract, not the company, even where the development key triggered the transaction. On MegaETH and Robinhood Chain, completeness for third-party calls into the delegated account relies on the explorer internal-call index, reconciled against 1,151 traced transactions. This describes historical flows, not a future remittance policy.

(a) Identity & role

As of 29 September 2026, no current non-issuer company APC is identified under this section's definition. Ekubo, Inc. is the primary DevCo and is excluded; GentlemenGerald is an individual technical service provider, not a company, and is disclosed in item 9. The former statement that there were four APCs was incorrect. Historical services included a 12-month Blockworks Advisory engagement authorized in August 2025 and CoinGecko/GeckoTerminal data integration. Neither is treated as a current company APC merely because a prior service was paid for; no continuing APC mandate or renewal is identified in the reviewed records.

(b) Parameter control & scope

No current company APC is identified; no APC parameter-control authority applies. Historical external service engagements conferred no protocol parameter-setting authority. Ekubo, Inc.'s distinct powers are described in item 5.

(c) Contract/admin powers

No current company APC is identified; no APC pause, upgrade or governance-executor authority applies. The historical external engagements conferred no such powers.

(d) Compensation and material economic arrangements

No current company APC or dynamic protocol-fee routing to a company APC is identified. For historical context, the DAO authorized 90,000 USDC for 12 months of Blockworks Advisory services in August 2025 and 30,000 USDC for CoinGecko integration via Ekubo, Inc. These were service payments, not a continuing protocol-revenue share. The individual technical contributor's 22,500 EKUBO stream is disclosed in item 9.

(a) Post-TGE employee lock as % of total supply

As of 29 September 2026, no post-TGE employee token compensation plan is disclosed. Employee tokens locked or unvested under such a plan: 0 EKUBO, or 0% of the fixed 10,000,000 EKUBO total supply. The independent DAO contractor stream in item 9 is not an employee plan.

(b) Typical post-TGE vesting schedule

No post-TGE employee token compensation plan exists; no cliff, vesting frequency or duration applies.

(a) Existence

Yes. The DAO treasury has an executed token-denominated technical-service stream running linearly from 7 October 2025 to 7 November 2026. This replaces the previous negative disclosure. The earlier 12-month proposal failed; the operative executed stream is approximately 13 months.

(b) Total token allocation

Aggregate committed allocation: 22,500 EKUBO, equal to 0.225% of total EKUBO supply. This includes paid/vested and reserved portions, not just the remaining unvested balance. No other EKUBO-denominated advisory allocation was identified in the reviewed records. USDC-only service fees are excluded.

(c) Payer entity

Ekubo DAO treasury, through its on-chain Streamed Payments contract. No foundation payer exists.

(d) Description of advisory/services

Technical point of contact, analytics maintenance and development, proposal coordination and DAO operational support. Executed proposal: https://ekubo.org/governance/proposals/0x808a4ae9719fd5782626c72f0ad59a8bd497a95a36d9850f20cc94c7507bf .

(a) Existence & scope

No ongoing EKUBO-paid KOL or influencer engagement is disclosed as of 29 September 2026. The two reviewed token-involving KOL proposals failed and did not authorize their proposed compensation. The item 9 technical contributor is not KOL marketing.

(b) Usernames & roles

None: no participating token-paid KOL handles or associated roles apply.

(c) Token allocation & vesting/locks

Aggregate token allocation for such ongoing engagements: 0 EKUBO. No associated cliff, vesting, lock or release terms apply.

(a) Token repurchases or secondary-market accumulations (if any)

Protocol-fee buyback mechanisms operate on Starknet and Ethereum. Governance also executed a discretionary 100,000 USDC buyback, principally funded from treasury resources originating in the token sale, with a separate 10,000 EKUBO hedge sale. The completed purchase order records 63,424.205387897649307336 EKUBO proceeds. The purchased tokens return to DAO control; they are not burned or irrevocably locked and can be re-released or otherwise used through governance. Proposal: https://ekubo.org/governance/proposals/0x729663c14e9e6389c7241c76a12827b827b60355f805d13f3e2281b1a41b5ba. Fee-funded buybacks on Starknet and Ethereum also return EKUBO to DAO control. It is not burned and may be re-used by proposal. Governance sets the fee share through the applicable governance-controlled contract paths.

(b) Protocol-owned liquidity (POL) (if any)

At the September 29, 2026 19:32:11–19:32:12 UTC indexed-state snapshot, 17 open DAO positions had aggregate principal market value of $1,785,882.52: eight Starknet positions ($129,483.84), eight Ethereum positions ($1,077,805.18) and one Robinhood Chain STONX/USDG position ($578,593.51). Independently rounded subtotals differ from the rounded grand total by one cent. The queried Arbitrum, Base and Optimism proxies had no indexed positions.

Starknet positions are EKUBO pairs with USDC, ETH, STRK, DAI, USDT, wstETH (including legacy) and WBTC. Ethereum positions include USDC/USDT, ETH/stablecoin, EKUBO/stablecoin, ETH/EKUBO and ETH/wstETH pools. The Robinhood Chain position is a Ve33 STONX/USDG pool. Governance controls these positions through the addresses in item 11 and can unwind or redeploy them by proposal. This is gross indexed principal marked to contemporaneous API prices, not a same-block withdrawal quote or guaranteed realizable value. Closed positions, wallet balances, unclaimed campaign earnings, LP fees and Ve33 accrual are excluded to prevent double counting.

Position views: https://ekubo.org/positions?forUser=0x053499f7aa2706395060fe72d00388803fb2dcc111429891ad7b2d9dcea29acd ; https://ekubo.org/positions?forUser=0x1E0EF4162e42C9bF820c307218c4E41cCcA6E9CC ; https://ekubo.org/positions?forUser=0xcd87828F4f279D3C5fD7af531370298964B5EAAb.

(c) Liquidity deals / purchased TVL (if any)

The following disclosed public liquidity-support authorizations are denominated by asset, rather than combined into an undated dollar total. Authorized amounts are not asserted to equal actual spending or presently outstanding commitments.

| Program | Authorized size | Participation / period |

|---|---|---|

| Oracle POL seeding | 54,000 EKUBO + 45,000 USDC + 12 ETH + 80,000 STRK | Starknet EKUBO oracle pools; one-time September 2024 capital, also included as POL where still held |

| Ethereum deployment incentives package 1/4 | 18,750 EKUBO | Three months from approximately May 2025 |

| Wave Zero boost | 4,687.5 EKUBO | USDC/USDT APY correction; June 2025 |

| Liquity PIL bribes and continuation | 24,000 USDC converted to BOLD | 11-week initial and subsequent approximately three-month programs in 2025; ended |

| Ethereum Wave One | 36,500 EKUBO | Scheduled from September 3, 2025 for three months; halted November 1 with remainder returned |

| Ethereum V3 incentives | 30,940 EKUBO | gEKUBO-lock campaign ended April 15, 2026 |

| EKUBO liquidity support | 100,000 EKUBO from company team tokens + 50 ETH DAO match | Ethereum EKUBO/ETH 1% boosted-fee pool, approximately six months from April 2026; active at cutoff |

| Ethereum USDC incentives | 91,000 USDC | High-fee pools; April 15–July 15, 2026; ended |

These authorizations total 244,877.5 EKUBO, 160,000 USDC, 62 ETH and 80,000 STRK, including the one-time POL seeding and returned/unused authorizations. They are not an incremental addition to the current POL value above. Separate externally supported campaigns include Starknet DeFi Spring (ended January 8, 2026) and BTCfi Season (active distribution schedule at cutoff: 29,826.14 STRK/day across nine pairs with positive rates; next scheduled distribution October 1). The displayed daily rate is not the lifetime budget or proof of future settlement. BOLD-denominated bribe-return distributions ended January 14, 2026. These are public incentive programs and POL authorizations rather than private purchased-TVL guarantees. The aggregate above covers the enumerated DAO/company authorizations, not the lifetime budgets of external STRK campaigns. External reward rates are separately disclosed; no unsupported external lifetime total or guaranteed liquidity amount is asserted.

(d) Token-secured loans/lines (incl. against unissued tokens) (if any)

No token-secured loans or credit lines exist or have existed, including against unissued tokens. This is confirmed by the founder as of October 3, 2026. The company’s charge card is unsecured and paid in full monthly.

(a) Entity existence

Foundation: none. Lab/DevCo: Ekubo, Inc., a Delaware corporation. DAO: Ekubo DAO, with governance on Starknet.

(b) Material sources of funding or economic inflows

The DAO received public-sale proceeds and a disclosed 6 million STRK catalyst grant (half upfront, half scheduled over 48 months). It holds treasury assets and liquidity positions and receives the applicable protocol-fee/buyback flows. The grant authorization is not represented as a currently available cash balance.

On Starknet, the disclosed current fee mechanism applies a fixed 20% protocol share when LP fees are collected; the original Ethereum Positions path collects a 10% swap-fee share. These paths route receipts to EKUBO buyback contracts. On other reviewed EVM Positions paths the owner can withdraw accrued protocol fees; those roles are held by the company key described in item 3. An automatic remittance from those company-controlled withdrawals to the DAO has not been established by the owner reads.

Ve33 pool swap fees go to voting STONX lockers. The DAO's own STONX/USDG position can earn STONX liquidity incentives; the company earns voter fees through its locks. These are not automatic EKUBO staking rewards or a DAO share of every Ve33 swap fee.

The DevCo's historical funding includes the $1.5 million/two-year DAO grant executed in July 2024, company token reserves and subsequent STONX locker receipts. The original service period has elapsed; no successor DAO grant was identified. No current runway or remaining-grant percentage is asserted.

(c) Operational use of resources

DAO proposals fund liquidity support, security, service providers, buybacks and other approved purposes. The DevCo uses resources for protocol development, audits, interface and infrastructure operations. No foundation expenditures apply. No automatic distribution to EKUBO stakers is implied.

(d) Onchain Resource Usage

- https://ekubo.org/governance/info — DAO portfolio and governance information; replaces the redirecting dao-treasury URL.

- https://ekubo.org/governance/proposals — treasury authorizations and execution records.

- https://ekubo.org/charts — protocol adoption/activity metrics.

- https://defillama.com/protocol/fees/ekubo — third-party fees and revenue series, subject to provider methodology.

- https://docs.ekubo.org/integration-guides/reference/contract-addresses#governance-contracts — governance contract references.

(a) Date & component affected

Limit Orders extension — Starknet: Exploited April 2, 2026 (Starknet block 8,389,431); the historical exploitation was identified in August 2026.

Huff Router approval incident — Ethereum / Arbitrum: May 5, 2026; affected peripheral Huff Router deployments, not Core or the EKUBO token contract.

(b) Exploit vector summary

Limit Orders extension — Starknet: An extension callback lacked a Core-only caller check. An attacker could mark an order executed without the corresponding swap and withdraw from pooled filled-order balances.

Huff Router approval incident — Ethereum / Arbitrum: A calldata-parsing flaw let an attacker supply an address from which an affected router pulled approved tokens, draining approving wallets.

(c) Quantified impact

Limit Orders extension — Starknet: The published post-mortem reports 47,123.33 USDC.e, 15,381.29 EKUBO and 0.457 ETH affected, approximately $55,000. Sixty-three open orders held by 41 addresses could not be withdrawn.

Huff Router approval incident — Ethereum / Arbitrum: Published analysis identifies approximately $1.42 million across assets, including 5,813.547755142307722539 EKUBO from four Ethereum addresses. A separate 15.806237743227243531 gEKUBO-26Q2 was taken from two additional addresses; this is not added to direct EKUBO losses without distinction. WBTC accounted for most value lost.

(d) Remediation/response taken

Limit Orders extension — Starknet: Governance deployed the caller-check fix on June 8, 2026 at 21:01:29 UTC, block 10,612,502, following the June 4 report/proposal. New order placement was deprecated. After discovering the earlier exploitation, the DAO funded the shortfall in September; the published restoration record reports affected balances restored September 21.

Huff Router approval incident — Ethereum / Arbitrum: Replacement routers corrected the parsing flaw; the interface stopped creating affected-router approvals. Finite approvals were cleared through a whitehat action. The immutable affected routers remain vulnerable and surviving unlimited approvals remain at risk until revoked. In June the DAO funded a recovery contract with assets worth approximately $300,000. Its EKUBO allocation is 5,829.353992885534966070, including 1:1 compensation for the separate gEKUBO losses. Claim acceptance includes a sanctions representation and release.

(e) Current status

Limit Orders extension — Starknet: The vulnerability is fixed and affected balances were restored at DAO expense. Stolen funds were not recovered. Restoration of balances is not recovery of the attacker's proceeds.

Huff Router approval incident — Ethereum / Arbitrum: Open. At September 29 Ethereum block 26,085,221, 12 of 31 eligible addresses had claimed. EKUBO claimed: 5,490.936506644602934989; unclaimed: 338.417486240932031081. Claims remain open and the fund's unclaimed allocations are backed. WBTC coverage is partial: 3.96506773 allocated against 17.01583735 identified lost. No claim that all victims have been made whole is made. The proposal described a 180-day claim period, but the contract has no automatic timestamp deadline: the DAO-controlled owner must call endClaims. Stolen funds have not been recovered.

(f) References

Limit Orders extension — Starknet: https://ekubo.org/governance/proposals/0x727b53063708fddc8c623b8e5272cec162a402b005b45f64d6a67816551f27e ; https://gist.github.com/moodysalem/63790287ff69bf43e163eebb001e9130 . The post-mortem's July fix-month wording conflicts with its cited block; the date above follows verified block/transaction evidence.

Huff Router approval incident — Ethereum / Arbitrum: https://github.com/EkuboProtocol/huff-router/tree/main/incident-report ; https://etherscan.io/address/0x5E1da6D39d2Aa65B4739EcE2CDE1Ae77d22ECA63.