Pith. sign in

REVIEW 3 major objections 5 minor 118 references

On Exercising Governance Power in Decentralized Autonomous Organizations

T0 review · 3 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that a DAO's governance design, not just its code, can be exploited, and names seven DAOs it considers currently vulnerable.

desk verdict A useful 48-DAO design taxonomy and a careful Compound case study, but the 'new class of governance attacks' and the 7-DAO vulnerability list are overclaimed without the economic feasibility analysis they need. read the letter →

arxiv 2607.26204 v1 pith:AFWT4HAW submitted 2026-07-28 cs.CR cs.CY

Vabuk Pahari , Balakrishnan Chandrasekaran , Johnnatan Messias , Krishna P. Gummadi , Abhisek Dash This is my paper · ORCID
classification cs.CRcs.CY
keywords DAOsblockchaingovernanceattacksvotesnipingbuyingsmartcontractsEthereumdecentralizedfinance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that many DAO failures are not implementation bugs but consequences of governance-contract design choices. Analyzing 48 actively used Ethereum DAOs, it classifies the referendum lifecycle—proposal, voting, certification, execution, veto—and shows how each choice trades off trust against decentralization. It introduces "governance attacks": attacks that exploit these mechanisms directly, even with bug-free code. Using the July 2024 Compound attack as a case study, it argues that three flaws—buyable voting power, no vote-sniping protection, and no oversight—together enable takeover, and that seven DAOs (Uniswap, Radicle, Gitcoin, Silo, Ampleforth, Hop, Cryptex) share all three. A sympathetic reader should care because these are design choices, not bugs, so they can be fixed deliberately.

What carries the argument

The key machinery is a lifecycle taxonomy of DAO referendums divided into pre-voting (who can propose, voting delay, opinion polls), voting (format, type, platform, aggregation), post-voting (certification, execution, delays), and veto. Each dimension is a design "knob" with trust and transparency consequences. The argument for the new attack class relies on a counterfactual classification rule—an incident counts as a governance attack if altering the governance mechanism would have prevented it—and on the co-occurrence of three flaws as a vulnerability signature: purchasable voting power, no vote-sniping defense, and no oversight. This three-part signature is what links the Compound case st

What would settle it

Compute the full economic cost of a vote-sniping takeover of one of the seven named DAOs: the cost of acquiring enough governance tokens to reach quorum plus a safe margin within the last voting window, including price impact and the risk of holding the tokens afterward. If for any of these DAOs that cost exceeds the value an attacker could extract from the protocol, or exceeds available market liquidity, the claim that the DAO is practically vulnerable would be falsified for that case.

Watch

Extended reading notes

Core claim

The paper's central claim is that a DAO's governance mechanism itself can be the attack surface. It labels an incident a "governance attack" when a change in the governance mechanism would have prevented it, and identifies three design flaws that together enable such attacks: governance tokens can be bought publicly and immediately confer voting power; voting periods are fixed, so votes can be rushed through at the last minute ("vote sniping"); and no vetoer or certifier can stop a maliciously passed proposal. In the July 2024 Compound case, an attacker accumulated roughly 682,000 COMP tokens, cast 82% of the yes-votes in the final 34 minutes, and passed a proposal transferring 499,000 COMP

Load-bearing premise

The argument rests on the counterfactual that an incident would have been prevented by a change in governance design, a judgment the authors apply rather than observe, and the seven-DAO vulnerability list assumes that the co-occurrence of buyable voting power, no vote-sniping protection, and no oversight is sufficient for a realistic attack without demonstrating liquidity, capital cost, or an actual exploit path.

Editorial extensions

If this is right

  • If the paper is right, any DAO with freely tradeable governance tokens, a fixed transparent voting window, and no veto mechanism can be taken over by buying tokens and sniping the final votes, regardless of how correct the smart-contract code is.
  • The seven named DAOs are at immediate risk; adding an oversight role (vetoer or certifier), extending voting when quorum is reached late, or restricting the voting power of freshly bought tokens would each disrupt the attack.
  • Security audits of DAOs should evaluate mechanism design, not just code correctness, because the vulnerabilities this paper identifies survive bug-free implementations.
  • Mitigations carry a cost: a vetoer or centralized certifier restores security by reducing decentralization, so DAO designers face an inherent trade-off between resilience and the ideal of decentralized governance.
  • The paper's finding that all on-chain voting DAOs let anybody certify and execute proposals implies that such DAOs need veto mechanisms or execution delays to protect users from a maliciously passed referendum.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The three-flaw checklist is a static screen, not a demonstrated exploit; actual exploitability also depends on token liquidity, the capital cost of acquiring quorum-plus-margin voting power, and typical voter turnout, so the true set of vulnerable DAOs could be larger or smaller than the seven named.
  • The root enabler is that voting power is an immediate function of token ownership; even anti-sniping and veto mechanisms may fail against a sufficiently wealthy attacker, so the deepest fix is decoupling voting power from instantaneous token balance (for example, time-weighted or vested voting).
  • A concrete next test would be to simulate a sniping attack against the seven DAOs using historical turnout and current order-book depth, computing the cost to reach the required quorum within the sniping window; DAOs where this cost is a small fraction of treasury value are the most probable targets.
  • Off-chain voting DAOs are not immune: their multi-signature executors replace vote sniping with a different, centralized failure mode, so the paper's taxonomy suggests these DAOs trade one attack class for another rather than eliminating governance risk.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies the governance contracts of 48 Ethereum-based DAOs selected by treasury size, categorizes design choices along a referendum lifecycle (pre-voting, voting, post-voting), and uses a July 2024 Compound case study to introduce a new attack class called "governance attacks" that exploit fundamental governance-mechanism design rather than smart-contract bugs. The authors claim that token-weighted voting with public token purchase, lack of vote-sniping protection, and absence of oversight (vetoer/certifier) constitute three inherent flaws, and that seven DAOs—Uniswap, Radicle, Gitcoin, Silo, Ampleforth, Hop, and Cryptex—are vulnerable to a similar attack. The paper also labels 16 of 28 previously documented incidents as governance attacks using a counterfactual criterion.

Significance. If the central claims were fully supported, this would be a useful contribution: it assembles a large governance-contract dataset, provides a detailed and internally consistent on-chain analysis of the Compound attack, and offers a design-level taxonomy that goes beyond bug-centric attack surveys. The promise to release data and code, and the use of on-chain vote-tally evidence in the Compound case study, are concrete strengths. However, the significance is currently limited by the gap between the rich case study and the broad cross-DAO vulnerability claims, which rest on static design features rather than an economic feasibility analysis.

major comments (3)
  1. [§IV-C, Table I] The claim that Uniswap, Radicle, Gitcoin, Silo, Ampleforth, Hop, and Cryptex are "vulnerable to a similar governance attack" is not supported by the presented evidence. The three flaws are operationalized only as binary entries in Table I (buyable voting power, no vote-sniping protection, no oversight). No per-DAO data is given on token liquidity, price impact of large purchases, borrowing availability, quorum thresholds, vote differential requirements, or expected attack cost vs. expected gain. Under the paper's own criterion, any DAO with a transferable governance token exhibits flaw (i), so the seven-DAO list is an artifact of missing economic analysis. To assert vulnerability, the authors must show a concrete accumulation path and quantify the cost and vote share required for each DAO; without that, the claim should be weakened to "potentially susceptible design features."
  2. [§IV-A] The classification of 16 incidents as governance attacks relies on the counterfactual "a change in the governance mechanism would have prevented the attack." This label is assigned by the authors and is not independently observable, and the same counterfactual is later used as evidence that design choices are the root cause. This creates a circularity: incidents are selected because they fit the design-exploitation narrative, and then the design is blamed. The paper should either define an independent, ex-ante criterion for governance attacks (e.g., attacker acquired voting power specifically to pass a proposal, or vote timing shows deliberate last-minute manipulation) or report sensitivity of the 16-incident count under alternative classification rules.
  3. [§IV-B, Compound case study] The Compound narrative is detailed but the extrapolation to other DAOs ignores two load-bearing features of that incident: the attacker accumulated tokens over four months using borrows through the Compound protocol itself and transfers from several centralized exchanges, and the proposal passed by only ~48,500 votes. Without comparable liquidity, borrow availability, or vote-margin data for the seven named DAOs, the Compound evidence alone cannot establish that those DAOs are vulnerable. The paper should provide at least a rough feasibility bound for each of the seven, including the size of the liquid market for the governance token and the minimum vote margin observed in recent comparable proposals.
minor comments (5)
  1. [§III-C2] Typo: "These privileges can be are assigned" should be "can be assigned".
  2. [§V] The name "Feichtilinger" in the related-work discussion is a typo; the reference [63] is "Feichtinger."
  3. [Figures 3 and 4] Figure 3 in Section IV-B and Figure 4 in Appendix A appear to show the same on-chain vote tally with nearly identical captions. Please unify or clearly differentiate them.
  4. [§I, contribution bullet] The contribution states the data and analysis code will be released "upon publication." For a study that depends on a curated dataset, consider making an anonymized artifact available during review to enable reproducibility checks.
  5. [General] The plural of "referendum" is used inconsistently ("referendums" and "referenda"). Please pick one convention throughout.

Circularity Check

1 steps flagged · score 4.0 of 10

Partial circularity: §IV-A defines 'governance attack' via the counterfactual that a governance-mechanism change would have prevented the attack, and the abstract restates that same criterion as the discovery that governance attacks exploit fundamental DAO design. The on-chain Compound case study and 48-DAO taxonomy are independent, so the score stays moderate.

  1. self definitional [Section IV-A ('Identifying Governance Attacks'); relied on by the Abstract and Section VI]
    "Of these incidents, we label 16 as Governance Attacks, based on the determination that a change in the governance mechanism would have prevented the attack. ... We also discover governance attacks, a distinct class of vulnerabilities, that exploit the governance mechanisms of DAOs, regardless of their implementations."

    The class 'governance attack' is defined by the counterfactual that a governance-mechanism change would have prevented the incident. The paper's central finding—that governance attacks 'directly exploit the fundamental design of a DAO's governance mechanisms'—is, by construction, the selection rule itself: only incidents judged preventable by a governance-mechanism change are admitted into the class, and their governance-mechanism causes are then reported as a discovery. The 'new class' claim thus partially reduces to the label rather than to the evidence. Independent content remains, because which specific features matter (buyable voting power, vote sniping, absent oversight) is established empirically through the Compound on-chain case and the Table I taxonomy; hence the circularity is p

full rationale

The paper's empirical backbone is self-contained and externally grounded: Table I classifies 48 DAOs from on-chain contracts and documentation; the Compound case study uses on-chain vote tallies and proposal records; the incident catalog is taken from an external SoK [63]; and no equations are fitted anywhere. Consequently no 'prediction' is statistically forced, and the minor self-citation [71] is background support for voting-cost effects, not load-bearing for the central derivation. The one genuine circular step is in §IV-A: 'governance attack' is defined as an incident that a governance-mechanism change would have prevented, and the headline claim that governance attacks 'directly exploit the fundamental design' restates that same counterfactual rule as an empirical discovery. I additionally note the §IV-C claim that seven DAOs are 'vulnerable' rests on a three-feature screen (buyable voting power, no vote-sniping protection, no veto/oversight) with no per-DAO liquidity, acquisition-cost, quorum, or exploit-path analysis; I weight that as an unsupported generalization/correctness risk rather than circularity, since the features are independently observed and no fitted parameter is involved. Overall: partial definitional circularity in the framing of the attack class, with substantial independent content, warranting a score of 4.

Assumptions & free parameters 3 free parameters · 4 assumptions · 1 invented entities

The paper's central claims rest on a handful of author-defined classification choices: which incidents count as governance attacks, which DAOs are included, and which design-feature combinations are deemed sufficient for vulnerability. These are not numerical fits, but they function as free parameters because changing them changes the reported prevalence and the list of vulnerable DAOs.

free parameters (3)
  • Governance attack classification criterion = 16 of 28 incidents from Feichtinger et al. [63] labeled as governance attacks
    Section IV-A labels incidents as governance attacks based on the counterfactual "a change in the governance mechanism would have prevented the attack." This threshold is author-defined and not independently measurable.
  • DAO inclusion criteria = 48 DAOs: largest treasuries, public, active in the 6 months before May 2024
    Section II selects DAOs using treasury size, public participation, and recent activity. These cutoffs are chosen by hand and shape all prevalence claims about the DAO ecosystem.
  • "Three inherent flaws" rule = 7 DAOs flagged as vulnerable
    Section IV-C flags DAOs that combine buyable voting power, no vote-sniping prevention, and no oversight. The sufficiency of these three conditions for a real attack is asserted, not measured or demonstrated.
assumptions (4)
  • domain assumption Voting power can be bought instantly on public markets, making token acquisition a viable attack path.
    Central to the vote-buying attack model in Sections III-B and IV-C; assumed for all public DAOs with transferable governance tokens.
  • ad hoc to paper It is knowable whether a change in the governance mechanism would have prevented a historical attack.
    This counterfactual is the defining criterion for "governance attacks" in Section IV-A. It is unfalsifiable and applied by the authors rather than derived from data.
  • domain assumption Etherscan-verified code and official documentation accurately reflect the governance mechanisms in use.
    The methodology in Section II relies on contract code fetched from Etherscan and developer documentation to classify each DAO's design choices.
  • domain assumption Attacks of interest are assumed to occur under bug-free implementations.
    The abstract and Section VI define governance attacks as exploiting fundamental design, "even if we assume bug-free implementations," which excludes smart-contract bugs from the model.
invented entities (1)
  • "Governance attacks" as a new attack class
    purpose: Categorizes 16 historical incidents as arising from design choices rather than implementation bugs.
    The class is defined by the paper's own counterfactual criterion in Section IV-A, so the label has no external benchmark. The underlying incidents are real, but whether they form a distinct class is not independently falsifiable.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On Exercising Governance Power in Decentralized Autonomous Organizations." pith.science (2026). https://pith.science/paper/AFWT4HAW

@misc{pith2026260726204,
  author       = {Pith},
  title        = {Pith review of: On Exercising Governance Power in Decentralized Autonomous Organizations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AFWT4HAW}},
  note         = {Machine review of arXiv:2607.26204}
}
abstract

A decentralized autonomous organization (DAO) is a governance entity that allows its stakeholders to manage blockchain-based protocols through smart contracts. The DAO explicitly specifies how stakeholders make and enforce decisions concerning a protocol's operation in a smart contract, aptly referred to as its governance contract. The design of this governance contract, therefore, has far-reaching implications for the security (trust) and privacy (transparency) of the smart contracts managed by the DAO and its stakeholders. In this work, we (i) explicate the trust and transparency trade-offs of the design choices in implementing a DAO and (ii) highlight how poor choices introduce critical vulnerabilities, using real-world examples as case studies. To this end, we analyze $48$ public, actively used Ethereum-based DAOs that control a vast capital. We classify the design choices into a handful of key dimensions that succinctly capture how a DAO's stakeholders initiate a protocol change, vote on it, and, based on the voting outcome, execute that change. Our analyses crucially uncover a new class of attacks, which we call governance attacks, that directly exploit the fundamental design of a DAO's governance mechanisms, even if we assume bug-free implementations.

Figures

Figures reproduced from arXiv: 2607.26204 by the authors.

Figure 1
Figure 1. Lifecycle of a referendum involving its birth, being put to vote, ratification of the voting, and, if approved, its execution. imum voting power until the proposal is executed, however, reduces nefarious referenda, since the proposer themselves must face the outcomes of the referendum. Authority-initiated referendas only allow a select group of stakeholders to initiate a referendum. Even if other users with substant… view at source ↗
Figure 2
Figure 2. Voting participation and number of votes cast in Uniswap for on-chain and off-chain voting. Procedurally, Uniswap uses an off-chain signaling vote before an official on-chain vote. We see there is a larger voter turnout in off￾chain votes, possibly because it is free, allowing small users to cast their votes. But, since this is only a signaling mechanism and not official, voters with large votes might not necessaril… view at source ↗
Figure 3
Figure 3. Voting Tally of the malicious proposal in Compound. We see that the number of votes in favor sharply increases shortly before the end of the voting period. we review real-world attacks on governance and identify feasible strategies to prevent them. A. Identifying Governance Attacks Feichtinger et al. analyzes attacks on DAOs and identifies 28 incidents [63]. Of these incidents, we label 16 as Governance Attacks, bas… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Voting Tally of the malicious proposal in Compound. We see that the number of votes in favor sharply increases shortly before the end of the voting period. Voting Anomalies. There are anomalies in the voting pattern and voters of Prop. #289. Firstly, 563,591 votes out …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

118 extracted references · 1 canonical work pages

  1. [1]

    Uniswap v3 core,

    H. Adams, N. Zinsmeister, M. Salem, R. Keefer, and D. Robinson, “Uniswap v3 core,” 2021

    2021

  2. [2]

    Flash boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability,

    P. Daian, S. Goldfeder, T. Kell, Y . Li, X. Zhao, I. Bentov, L. Brei- denbach, and A. Juels, “Flash boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability,” in2020 IEEE Symposium on Security and Privacy (SP), 2020

    2020

  3. [3]

    Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit,

    K. Qin, L. Zhou, B. Livshits, and A. Gervais, “Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit,” inFinancial Cryp- tography and Data Security, ser. FC ’21, 2021

    2021

  4. [4]

    Liquidations: Defi on a knife-edge,

    D. Perez, S. M. Werner, J. Xu, and B. Livshits, “Liquidations: Defi on a knife-edge,” inFinancial Cryptography and Data Security, ser. FC ’21, 2021

    2021

  5. [5]

    DefiLlama, https://defillama.com, 2024, accessed on May 15, 2024

    2024

  6. [6]

    DeepDAO, https://deepdao.io, 2024, accessed on May 15, 2024

    2024

  7. [7]

    Governance – Uniswap Protocol,

    Uniswap Labs, “Governance – Uniswap Protocol,” https://uniswap.org/ governance, 2023, accessed on April 2, 2023

    2023

  8. [8]

    Ens docs,

    ENS, “Ens docs,” https://docs.ens.domains/dao, 2024, accessed on May 15, 2024

    2024

Show all 118 references
  1. [9]

    Governance Module – Maker Protocol Technical Docs,

    MakerDAO, “Governance Module – Maker Protocol Technical Docs,” https://docs.makerdao.com/smart-contract-modules/governance- module, 2023, accessed on April 2, 2023

    2023

  2. [10]

    Active motions,

    Lido, “Active motions,” https://easytrack.lido.fi, 2024, accessed on May 15, 2024

    2024

  3. [11]

    Lido governance process,

    ——, “Lido governance process,” https://lido.fi/governance, 2024, ac- cessed on May 15, 2024

    2024

  4. [12]

    Frax governance overview,

    Frax Finance, “Frax governance overview,” https://docs.frax.finance/ frax-governance/frax-governance-overview, 2024, accessed on May 15, 2024

    2024

  5. [13]

    AA VE Economics – Governance,

    AA VE, “AA VE Economics – Governance,” https://docs.aave.com/ aavenomics/governance, 2023, accessed on May 25, 2023

    2023

  6. [14]

    Compound Governance,

    Compound Labs, Inc., “Compound Governance,” https: //docs.compound.finance/governance, 2022, accessed on Dec 10, 2022

    2022

  7. [15]

    How we work,

    Radicle, “How we work,” https://docs.radworks.org/community/ ecosystem, 2024, accessed on May 15, 2024

    2024

  8. [16]

    0x protocol governance,

    0x Protocol, “0x protocol governance,” https://governance.0xprotocol. org, 2024, accessed on May 15, 2024

    2024

  9. [17]

    Gitcoin,

    Gitcoin, “Gitcoin,” https://www.gitcoin.co, 2023, accessed on May 15, 2024

    2023

  10. [18]

    Governance,

    Silo Finance, “Governance,” https://silopedia.silo.finance/silodao/ governance, 2024, accessed on May 15, 2024

    2024

  11. [19]

    Governance,

    Lyra, “Governance,” https://docs.lyra.finance/docs/governance, 2024, accessed on May 15, 2024

    2024

  12. [20]

    Contracts,

    API3, “Contracts,” https://docs.api3.org/reference/dao-members, 2024, accessed on May 15, 2024

    2024

  13. [21]

    About forth governance,

    Ampleforth, “About forth governance,” https://docs.ampleforth.org/ learn/about-forth-governance, 2024, accessed on May 15, 2024

    2024

  14. [22]

    V oting and governance,

    Instadapp, “V oting and governance,” https://guides.instadapp.io/ governance/voting-and-governance, 2024, accessed on May 15, 2024

    2024

  15. [23]

    Governance,

    Rari Foundation, “Governance,” https://rari-foundation.gitbook.io/rari- dao-knowledge-base/governance, 2024, accessed on May 15, 2024

    2024

  16. [24]

    Welcome to Nouns Center,

    Nouns, “Welcome to Nouns Center,” https://nouns.center, 2024, ac- cessed on May 15, 2024

    2024

  17. [25]

    Curve DAO: Protocol Ownership,

    Curve, “Curve DAO: Protocol Ownership,” https://curve.readthedocs. io/dao-ownership.html, 2024, accessed on May 15, 2024

    2024

  18. [26]

    Origin DeFi Docs,

    Origin DeFi, “Origin DeFi Docs,” https://docs.oeth.com/governance/ overview, 2024, accessed on May 15, 2024

    2024

  19. [27]

    Into to Hop DAO,

    Hop, “Into to Hop DAO,” https://docs.hop.exchange/governance/into- to-hop-dao, 2024, accessed on May 15, 2024

    2024

  20. [28]

    Reference,

    Cryptex Finance, “Reference,” https://docs.cryptex.finance/governance/ reference, 2024, accessed on May 15, 2024

    2024

  21. [29]

    Angle Protocol, https://docs.angle.money/governance/angle-dao, 2024, accessed on May 15, 2024

    2024

  22. [30]

    DxDao, https://dxdocs.eth.limo/docs/Governance, 2024, accessed on May 15, 2024

    2024

  23. [31]

    Nexus Mutual, https://docs.nexusmutual.io, 2024, accessed on May 15, 2024

    2024

  24. [32]

    Governance,

    Goldfinch Finance, “Governance,” https://docs.goldfinch.finance/ goldfinch/governance, 2024, accessed on May 15, 2024

    2024

  25. [33]

    ParagonsDAO, https://docs.paragonsdao.com/docs/dao/governance- framework, 2024, accessed on May 15, 2024

    2024

  26. [34]

    Illuvium, https://illuvium.io/governance, 2024, accessed on May 15, 2024

    2024

  27. [35]

    The SuperRare DAO,

    SuperRare, “The SuperRare DAO,” https://docs.superrare.com/ whitepapers/master/the-superrare-dao, 2024, accessed on May 15, 2024

    2024

  28. [36]

    Governance,

    Mantle, “Governance,” https://docs.mantle.xyz/governance/parameters/ governance, 2024, accessed on May 15, 2024

    2024

  29. [37]

    ResearchHub Docs,

    ResearchHub, “ResearchHub Docs,” https://docs.researchhub.com, 2024, accessed on May 15, 2024

    2024

  30. [38]

    User Docs,

    Stargate Finance, “User Docs,” https://stargateprotocol.gitbook.io/ stargate/v/user-docs, 2024, accessed on May 15, 2024

    2024

  31. [39]

    UMA Protocol,

    Uma Project, “UMA Protocol,” https://docs.uma.xyz, 2024, accessed on May 15, 2024

    2024

  32. [40]

    Governance,

    Cow Protocol, “Governance,” https://docs.cow.fi/governance, 2024, ac- cessed on May 15, 2024

    2024

  33. [41]

    Sturdy Finance, https://docs.sturdy.finance/sturdy-dao/governance, 2024, accessed on May 15, 2024

    2024

  34. [42]

    Euler Finance, https://gov.euler.finance, 2024, accessed on May 15, 2024

    2024

  35. [43]

    SAFE, https://safe-global.notion.site/Introduction-to-SafeDAO- 07f87ad6c9bf456ca5d349e72e85bf3f, 2024, accessed on May 15, 2024

    2024

  36. [44]

    Tokenlon, https://support.tokenlon.im/hc/en-us/sections/ 360011548392-Governance, 2024, accessed on May 15, 2024

    2024

  37. [45]

    Governance,

    Botto, “Governance,” https://docs.botto.com/details/governance, 2024, accessed on May 15, 2024

    2024

  38. [46]

    Governance,

    Balancer, “Governance,” https://docs.balancer.fi/concepts/governance, 2024, accessed on May 15, 2024

    2024

  39. [47]

    Current governance model,

    Sushiswap, “Current governance model,” https://docs.sushi.com/docs/ Governance/Current%20Governance%20Model, 2024, accessed on May 15, 2024

    2024

  40. [48]

    Gearbox, https://docs.gearbox.finance/governance/setup, 2024, ac- cessed on May 15, 2024

    2024

  41. [49]

    Paraswap, https://doc.paraswap.network/dao-and-governance/daos- mission, 2024, accessed on May 15, 2024

    2024

  42. [50]

    Alchemix Finance, https://alchemix-finance.gitbook.io/user-docs/ alchemix-dao/community-governance-process, 2024, accessed on May 15, 2024

    2024

  43. [51]

    1inch, https://docs.1inch.io/docs/governance/overview, 2024, accessed on May 15, 2024

    2024

  44. [52]

    Shutter DAO 0x36, https://shutter.network/dao, 2024, accessed on May 15, 2024

    2024

  45. [53]

    Yearn Finance, https://docs.yearn.fi/contributing/governance/ governance-and-operations, 2024, accessed on May 15, 2024

    2024

  46. [54]

    ShapeShift, https://shapeshift.notion.site/FOX-Governance-Process- e5e999c1f23c4127aeeea1494621c226, 2024, accessed on May 15, 2024

    2024

  47. [55]

    What is the dao,

    Decentraland, “What is the dao,” https://docs.decentraland.org/player/ general/dao/overview/what-is-the-dao, 2024, accessed on May 15, 2024

    2024

  48. [56]

    The Graph Council,

    Graph Foundation, “The Graph Council,” https://docs.thegraph. academy/the-graph-ecosystem/organizational-structure/the-graph- council, 2024, accessed on May 15, 2024

    2024

  49. [57]

    Snapshot,

    S. Labs, “Snapshot,” https://snapshot.org, 2023, accessed on February 2, 2023

    2023

  50. [58]

    Snapshot,

    ——, “Snapshot,” https://docs.snapshot.org/tools/api, 2023, accessed on August 2, 2023

    2023

  51. [59]

    Crypto rug pulls: What are they and how to avoid them,

    California Secretary of State, “Crypto rug pulls: What are they and how to avoid them,” https://www.sos.ca.gov/elections/ballot-measures/ how-qualify-initiative, accessed on 1 June, 2024

    2024

  52. [60]

    Calling a general election,

    Institute for Government, “Calling a general election,” https://www. instituteforgovernment.org.uk/explainer/calling-general-election, 2024, accessed on 1 June, 2024

    2024

  53. [61]

    DxDao, https://dxvote.eth.limo/#/mainnet/info?view=governance, ac- cessed on 1 June, 2024

    2024

  54. [62]

    Facilitatordaos,

    MakerDAO, “Facilitatordaos,” https://endgame.makerdao.com/subdaos/ types/facilitator, 2023, accessed on May 15, 2024

    2023

  55. [63]

    SoK: Attacks on DAOs,

    R. Feichtinger, R. Fritsch, L. Heimbach, Y . V onlanthen, and R. Wat- tenhofer, “SoK: Attacks on DAOs,” in6th Conference on Advances in Financial Technologies (AFT 2024), 2024

    2024

  56. [64]

    Dao decentralization: V oting-bloc entropy, bribery, and dark daos,

    J. Austgen, A. F ´abrega, S. Allen, K. Babel, M. Kelkar, and A. Juels, “Dao decentralization: V oting-bloc entropy, bribery, and dark daos,” arXiv preprint arXiv:2311.03530, 2023

    2023 arXiv

  57. [65]

    Shutter, https://blog.shutter.network/shielded-voting, 2024, accessed on August 1, 2024

    2024

  58. [66]

    Unpacking how decentralized autonomous organizations (daos) work in practice,

    T. Sharma, Y . Kwon, K. Pongmala, H. Wang, A. Miller, D. Song, and Y . Wang, “Unpacking how decentralized autonomous organizations (daos) work in practice,” 2023

    2023

  59. [67]

    Thwarting last-minute voter coercion,

    R. Giustolisi, M. S. Garjan, and C. Schuermann, “Thwarting last-minute voter coercion,” Cryptology ePrint Archive, Paper 2023/1876, 2023, https://eprint.iacr.org/2023/1876. [Online]. Available: https://eprint.iacr.org/2023/1876

    2023

  60. [68]

    E-vote your conscience: Percep- tions of coercion and vote buying, and the usability of fake credentials in online voting,

    L.-H. Merino, A. Azhir, H. Zhang, S. Colombo, B. Tellenbach, V . Estrada-Gali˜nanes, and B. Ford, “E-vote your conscience: Percep- tions of coercion and vote buying, and the usability of fake credentials in online voting,” 2024

    2024

  61. [69]

    Ipfs powers the distributed web,

    P. Labs, “Ipfs powers the distributed web,” https://ipfs.tech, 2023, accessed on February 2, 2023

    2023

  62. [70]

    Governance in DeFi,

    Lucas Tcheyan, “Governance in DeFi,” https://www.galaxy.com/ insights/research/governance-in-defi, 2024, accessed on May 15, 2024

    2024

  63. [71]

    Understanding blockchain governance: Analyzing decen- tralized voting to amend defi smart contracts,

    J. Messias, V . Pahari, B. Chandrasekaran, K. P. Gummadi, and P. Loiseau, “Understanding blockchain governance: Analyzing decen- tralized voting to amend defi smart contracts,” 2024

    2024

  64. [72]

    Sok: Com- munication across distributed ledgers,

    A. Zamyatin, M. Al-Bassam, D. Zindros, E. Kokoris-Kogias, P. Moreno-Sanchez, A. Kiayias, and W. J. Knottenbelt, “Sok: Com- munication across distributed ledgers,” inFinancial Cryptography and Data Security, N. Borisov and C. Diaz, Eds. Berlin, Heidelberg: Springer Berlin Heide...

    2021

  65. [73]

    About V oting,

    United States Senate, “About V oting,” https://www.senate.gov/about/ powers-procedures/voting.htm, 2024, accessed on May 15, 2024

    2024

  66. [74]

    An introduction to vote-counting schemes,

    J. Levin and B. Nalebuff, “An introduction to vote-counting schemes,”Journal of Economic Perspectives, vol. 9, no. 1, p. 3–26, March 1995. [Online]. Available: https://www.aeaweb.org/articles?id= 10.1257/jep.9.1.3

    1995 doi

  67. [75]

    An empirical study on snapshot daos,

    Q. Wang, G. Yu, Y . Sai, C. Sun, L. Nguyen, S. Xu, and S. Chen, “An empirical study on snapshot daos,” 11 2022

    2022

  68. [76]

    An explanation of continuous voting and the peculiarities of the 7/26 executive stability fee vote,

    psybull, “An explanation of continuous voting and the peculiarities of the 7/26 executive stability fee vote,” https://forum.makerdao.com/t/an-explanation-of-continuous-voting- and-the-peculiarities-of-the-7-26-executive-stability-fee-vote/193, accessed on 1 June, 2024

    2024

  69. [77]

    U.s. congress certifies the electoral college vote,

    U.S. Embassy and Consulates in Brazil, “U.s. congress certifies the electoral college vote,” https://br.usembassy.gov/u-s-congress-certifies- the-electoral-college-vote, accessed on 1 June, 2024

    2024

  70. [78]

    Chaos labs risk parameter updates - crv aave v2 ethereum,

    “Chaos labs risk parameter updates - crv aave v2 ethereum,” https: //www.tally.xyz/gov/aave/proposal/280, 2024, accessed on August 1, 2024

    2024

  71. [79]

    Kleros, https://github.com/kleros/kleros/blob/master/contracts/kleros/ KlerosGovernor.sol, 2024, accessed on 1 June, 2024

    2024

  72. [80]

    Announcing “oSnap:

    Uma Project, “Announcing “oSnap:” Gasless Snapshot voting with on-chain execution by UMA,” https://medium.com/uma-project/ announcing-osnap-gasless-snapshot-voting-with-on-chain-execution- by-uma-7374ed729b28, 2024, accessed on May 15, 2024

    2024

  73. [81]

    UMA, https://docs.uma.xyz/developers/osnap, 2024, accessed on Au- gust 1, 2024

    2024

  74. [82]

    Cow dao integrates osnap for decentralized governance,

    ——, “Cow dao integrates osnap for decentralized governance,” https:// cow.fi/learn/cow-dao-integrates-o-snap-for-decentralized-governance, 2024, accessed on August 1, 2024

    2024

  75. [83]

    SuperRare, https://snapshot.org/#/superraredao.eth /proposal/0x9223e· · ·66383, 2024, accessed on May 15, 2024

    2024

  76. [84]

    ——, https://snapshot.org/#/superraredao.eth/ proposal/0x1422c· · ·a8e8a, 2024, accessed on May 15, 2024

    2024

  77. [85]

    Venus protocol prevented hostile takeover attempt,

    Rikta Mandal, “Venus protocol prevented hostile takeover attempt,” https://www.cryptotimes.io/2021/09/18/venus-protocol-prevented- hostile-takeover-attempt, accessed on 15 August, 2024

    2021

  78. [86]

    [Temp Check] Enable CANCEL role on the DAO,

    ENS, “[Temp Check] Enable CANCEL role on the DAO,” https://discuss.ens.domains/t/temp-check-enable-cancel-role-on- the-dao/19090, 2024, accessed on May 15, 2024

    2024

  79. [87]

    [ep5.13][executable] security council,

    alextnetto.eth, “[ep5.13][executable] security council,” https://discuss. ens.domains/t/introducing-veto-ensdao-eth/19088/5, 2024, accessed on August 1, 2024

    2024

  80. [88]

    Add proposal guardian to governor bravo,

    “Add proposal guardian to governor bravo,” https://compound.finance/ governance/proposals/304, accessed on 15 August, 2024

    2024

  81. [89]

    Indexed DAO to distribute remaining treasury after defeat- ing hijack attempts,

    The Block, “Indexed DAO to distribute remaining treasury after defeat- ing hijack attempts,” https://www.theblock.co/post/264679/indexed- dao-to-distribute-remaining-treasury-after-defeating-hijack-attempts, 2024, accessed on May 15, 2024

    2024

  82. [90]

    Yuan governance attack update and migra- tion plan,

    Yuan Finance, “Yuan governance attack update and migra- tion plan,” https://medium.com/yuan-finance/yuan-governance-attack- update-and-migration-plan-3b5d949ab466, accessed on 1 June, 2024

    2024

  83. [91]

    Trust setup for dao investment into goldcomp,

    “Trust setup for dao investment into goldcomp,” https://compound. finance/governance/proposals/289, accessed on 15 August, 2024

    2024

  84. [92]

    KuCoin, https://www.kucoin.com, 2024, accessed on 1 June, 2024

    2024

  85. [93]

    ByBit, https://www.bybit.com/en, 2024, accessed on 1 June, 2024

    2024

  86. [94]

    HTX, https://www.htx.com, 2024, accessed on 1 June, 2024

    2024

  87. [95]

    OKX, https://www.okx.com, 2024, accessed on 1 June, 2024

    2024

  88. [96]

    Governance security notice: goldcomp proposal 247,

    cylon, “Governance security notice: goldcomp proposal 247,” https://www.comp.xyz/t/governance-security-notice-goldcomp- proposal-247/5220/1, accessed on 1 June, 2024

    2024

  89. [97]

    “Treasury to invest 5

  90. [98]

    Trust setup for dao investment into goldcomp,

    “Trust setup for dao investment into goldcomp,” https://compound. finance/governance/proposals/279, accessed on 15 August, 2024

    2024

  91. [99]

    Compound community forum,

    C. Labs, “Compound community forum,” https://www.comp.xyz, 2024, accessed on May 7, 2024

    2024

  92. [100]

    Bitcoin Improvement Proposals,

    “Bitcoin Improvement Proposals,” https://github.com/bitcoin/bips, ac- cessed on January, 2025

    2025

  93. [101]

    Ethereum Improvement Proposals,

    “Ethereum Improvement Proposals,” https://eips.ethereum.org/, ac- cessed on January, 2025

    2025

  94. [102]

    The one true bitcoin,

    T. Verge, “The one true bitcoin,” https://www.theverge.com/2018/4/12/ 17229796/bitcoin-cash-conflict-transactions-fight, 2018, accessed on May 12, 2024

    2018

  95. [103]

    Segwit goes live: Why bitcoin’s big upgrade is a blockchain game-changer,

    CoinDesk, “Segwit goes live: Why bitcoin’s big upgrade is a blockchain game-changer,” https://www.coindesk.com/markets/2017/ 08/23/segwit-goes-live-why-bitcoins-big-upgrade-is-a-blockchain- game-changer, 2017, accessed on May 12, 2024

    2017

  96. [104]

    Stick a fork in it: Analyzing the ethereum network partition,

    L. Kiffer, D. Levin, and A. Mislove, “Stick a fork in it: Analyzing the ethereum network partition,” inProceedings of the 16th ACM Workshop on Hot Topics in Networks, ser. HotNets ’17. New York, NY , USA: Association for Computing Machinery, 2017, p. 94–100. [Online]. Availabl...

    2017

  97. [105]

    Coindesk turns 10: 2016 - how the dao hack changed ethereum and crypto,

    CoinDesk, “Coindesk turns 10: 2016 - how the dao hack changed ethereum and crypto,” https://www.coindesk.com/consensus-magazine/ 2023/05/09/coindesk-turns-10-how-the-dao-hack-changed-ethereum- and-crypto, 2023, accessed on May 12, 2024

    2016

  98. [106]

    Decentralized crypto governance? transparency and concentration in ethereum decision-making,

    C. Fracassi, M. Khoja, and F. Sch ¨ar, “Decentralized crypto governance? transparency and concentration in ethereum decision-making,” 2024

    2024

  99. [107]

    Governance in blockchain technologies & social contract theories,

    W. Reijers, F. O’Brolch ´ain, and P. Haynes, “Governance in blockchain technologies & social contract theories,”Ledger, vol. 1, 2016

    2016

  100. [108]

    Blockchain governance: What we can learn from the economics of corporate governance,

    D. Allen and C. Berg, “Blockchain governance: What we can learn from the economics of corporate governance,”SSRN Electronic Jour- nal, 01 2020

    2020

  101. [109]

    Governance of blockchain systems: Governance of and by Distributed Infrastructure,

    P. de Filippi and G. Mcmullen, “Governance of blockchain systems: Governance of and by Distributed Infrastructure,” Blockchain Research Institute and COALA, Research Report, 2018. [Online]. Available: https://hal.science/hal-02046787

    2018

  102. [110]

    Analyzing voting power in decentralized governance: Who controls daos?

    R. Fritsch, M. M ¨uller, and R. Wattenhofer, “Analyzing voting power in decentralized governance: Who controls daos?” 2022

    2022

  103. [111]

    The hidden shortcomings of (d)aos – an empirical study of on-chain governance,

    R. Feichtinger, R. Fritsch, Y . V onlanthen, and R. Wattenhofer, “The hidden shortcomings of (d)aos – an empirical study of on-chain governance,” 2023

    2023

  104. [112]

    The governance of decentralized autonomous organizations: A study of contributors’ influence, networks, and shifts in voting power,

    S. Kitzler, S. Balietti, P. Saggese, B. Haslhofer, and M. Strohmaier, “The governance of decentralized autonomous organizations: A study of contributors’ influence, networks, and shifts in voting power,” 2023

    2023

  105. [113]

    Sok: Blockchain governance,

    A. Kiayias and P. Lazos, “Sok: Blockchain governance,” 2023

    2023

  106. [114]

    Open problems in daos,

    J. Z. Tan, T. Merk, S. Hubbard, E. R. Oak, J. Pirovich, E. Rennie, R. Hoefer, M. Zargham, J. Potts, C. Berget al., “Open problems in daos,”arXiv preprint arXiv:2310.19201, 2023

    2023 arXiv

  107. [115]

    https://etherscan.io/address/0x36cc7· · ·2ffc6, accessed on 15 August, 2024

    2024

  108. [116]

    https://etherscan.io/address/0x941dc· · ·EB1C2, accessed on 15 Au- gust, 2024

    2024

  109. [117]

    Precautionary transfer of timelock admin,

    “Precautionary transfer of timelock admin,” https://compound.finance/ governance/proposals/290, accessed on 15 August, 2024

    2024

  110. [118]

    [alphagrowth] stake compound product,

    bryancolligan, “[alphagrowth] stake compound product,” https://www. comp.xyz/t/alphagrowth-stake-compound-product/5478, accessed on 15 August, 2024. APPENDIX A. Compound Case study Attack TimelineOn May 6th, 2024, a proposal was put forth by Humpy [115], a known DeFi whale, in...

    2024

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.