Decentralized autonomous organizations, or DAOs, face a fundamental tension between protecting assets and maintaining genuine democratic participation. A July 2024 incident at Compound protocol illustrates the problem: wallets accumulated over 680,000 COMP tokens in the final hours of a vote to transfer $24 million into a yield-bearing vehicle, passing a controversial proposal despite earlier rejection. While the code functioned as designed, Compound lacked emergency controls to pause execution, leading the protocol to add a veto role after the fact.
Research from the Max Planck Institute for Software Systems and Vrije Universität Amsterdam examined 48 large Ethereum DAOs and identified how security features create unintended gatekeeping. Registration requirements, designed to separate circulating tokens from unvested allocations, leave only 21% of tokens in the practical electorate on average across studied DAOs. Meanwhile, centralized exchanges and DeFi protocols hold over 13% of outstanding tokens on average—enough to outnumber registered voters in 14 DAOs—creating custody arrangements where custodians control governance despite representing thousands of individual owners.
Staking mechanisms that lock tokens to prevent flash attacks have generated a parallel problem. Cryptocurrency services now maintain long-term locks, issue tradable substitutes, and control the underlying voting rights, concentrating enormous blocs. Convex controls 53% of Curve governance votes and 46% of Frax votes, while StakeDAO controls 57% of Angle's votes.
Delegation amplifies concentration further. The ten largest holders controlled more than half of voting power in 39 of the 48 DAOs studied, with delegated voting typically more concentrated than direct voting. Most token holders lack appetite for governance participation, making delegation to professional participants rational individually but aggregating into durable political blocs.
Researchers classified governance attacks as actors using authorized processes to win outcomes that harm the wider organization. Among 28 DAO incidents examined, 16 could have been prevented by alternative mechanisms. Ten involved acquiring sufficient tokens to influence votes, while six involved contract bugs. Seven additional DAOs besides Compound showed exposure to late-stage voting power accumulation: Uniswap, Radicle, Gitcoin, Silo, Ampleforth, Hop, and Cryptex.
The dilemma cuts both ways: defenses against rushed or hostile votes necessarily give someone more control, whether reactive voters, committed holders, locking services, or emergency bodies. DAOs can distribute ownership across thousands of wallets while funneling practical control toward a few dozen professionals, custodians, and large holders—with software executing flawlessly throughout.
