DAOs & Governance

What Is a DAO?

A DAO (Decentralized Autonomous Organization) is an organization governed by its members through blockchain-based voting rather than a traditional corporate hierarchy. Instead of a CEO making decisions, token holders vote on proposals — everything from how treasury funds are spent to what features get built. The rules of the organization are encoded in smart contracts, making them transparent and automatically enforced. Think of it like a company where every shareholder gets to vote on every major decision, and the results are executed automatically by code.

Governance Tokens

Governance tokens give holders voting power in a DAO. Owning UNI tokens lets you vote on Uniswap protocol changes. Holding AAVE lets you vote on Aave protocol parameters. The more tokens you hold, the more voting power you have. Some protocols distribute governance tokens to early users (retroactive airdrops), while others sell them or distribute them through liquidity mining. Governance tokens often also have market value, so they function as both a voting right and a financial asset.

How DAO Voting Works

A typical DAO governance process follows these steps: someone drafts a proposal (usually discussed on a forum first), the proposal is put up for an on-chain or off-chain vote, token holders cast their votes during a voting period (usually 3-7 days), and if the proposal passes (meets quorum and majority requirements), it is executed. Many DAOs use Snapshot for gasless off-chain voting and then execute approved proposals on-chain through a multi-sig or timelock contract.

Delegation and Vote Concentration

Most token holders never vote — participation rates in DAO governance are typically 5-15% of eligible tokens. To address this, most DAOs support delegation: you can assign your voting power to a delegate who votes on your behalf. Delegates are usually active community members, protocol researchers, or organizations who publicly share their voting rationale. You retain your tokens and can re-delegate or revoke delegation at any time. Platforms like Karma, Tally, and Agora track delegate voting histories and participation rates.

Treasury Management

Major DAOs control enormous treasuries — Uniswap's treasury holds billions in UNI tokens, Arbitrum DAO manages over $3 billion in ARB. Treasury management is one of the most consequential governance decisions: how much to spend on grants, development, marketing, and liquidity incentives. Effective treasury management involves diversifying beyond the native token (converting some holdings to stablecoins and ETH), setting up streaming payments for ongoing expenses, and maintaining enough runway to fund operations for years regardless of market conditions.

Governance Models

• Token-weighted voting — one token equals one vote; simple but plutocratic (whales dominate)
• Quadratic voting — voting power scales with the square root of tokens committed; reduces whale dominance but vulnerable to Sybil attacks
• Conviction voting (used by Giveth, 1Hive) — voting power increases the longer tokens are staked on a proposal; favors persistent community support over impulsive votes
• Optimistic governance (used by Optimism) — proposals pass by default unless vetoed within a challenge period; reduces voter fatigue for routine decisions
• Council-based (used by Synthetix, dYdX) — elected councils handle day-to-day decisions; broader token votes reserved for constitutional changes

Governance Attacks and Defensive Mechanisms

Governance attacks are an increasingly serious threat to DAOs. In a governance attack, a malicious actor acquires enough voting power (through token purchases, flash loans, or bribery) to pass a proposal that drains the treasury or alters protocol parameters in their favor. Beanstalk was exploited for $182 million when an attacker used a flash loan to temporarily acquire enough governance tokens to pass a malicious proposal in a single transaction. This demonstrated that any DAO allowing governance actions within the same transaction as token acquisition is fundamentally insecure.

Governance Attack Vectors

• Flash loan governance attacks — borrow tokens, vote, repay in one transaction; mitigated by snapshot-based voting where voting power is measured at a past block
• Vote buying and bribery — platforms like Votium and Hidden Hand enable explicit bribe markets for governance votes (the 'Curve Wars' demonstrated this at scale)
• Hostile takeover — gradually accumulating tokens to gain majority control; decentralized protocols are especially vulnerable because there is no board of directors to mount a defense
• Social engineering — manipulating community sentiment through coordinated forum posts, fake research, and manufactured consensus to push through harmful proposals
• Timelock bypass — exploiting short timelock durations to execute malicious proposals before the community can respond

Defensive Governance Design

Well-designed governance systems implement multiple defensive layers. Timelocks (24-72 hours between approval and execution) give the community time to react to malicious proposals. Quorum requirements (minimum participation thresholds) prevent low-turnout attacks. Vote escrow models (Curve's veCRV) require tokens to be locked for months or years, making flash loan attacks impossible and aligning voter incentives with long-term protocol health. Governance guardians or security councils (Arbitrum's Security Council, Optimism's Guardian) can veto or pause malicious proposals as a last resort. The challenge is balancing security (more restrictions) with agility (faster decision-making).