What Is a DAO?

A DAO, or decentralized autonomous organization, is a group that makes decisions through votes recorded on a blockchain and carried out by smart contracts, usually with governance tokens as voting power. Most large DeFi protocols are governed this way. DAOs can be more open than companies, but face low turnout and attacks on voting itself.

How a DAO works

1. Someone proposes a change, such as adjusting a fee, adding a new asset or spending treasury funds.
2. Token holders vote, often weighted by how many governance tokens they hold or have delegated to them.
3. If the proposal passes, a smart contract carries it out, often after a waiting period called a timelock.

Many DAOs discuss proposals in forums first and use off-chain polls before an on-chain vote. Our article on utility vs governance tokens explains what governance tokens do.

Figure: The typical path of a DAO proposal.

A proposal’s journey in practice

In most large DAOs, a change passes through several stages before anything happens on-chain. An idea is posted in the community forum for discussion and feedback. If it gains support, a non-binding “temperature check” poll gauges interest, often using an off-chain voting tool that costs nothing to use. A formal proposal is then written with specific parameters and put to an on-chain vote, which requires a minimum turnout, called a quorum, to be valid. If it passes, it usually waits in a timelock for a set period before the smart contract carries it out. The whole process can take weeks, which protects against rushed decisions but makes quick responses difficult.

Delegation

Most token holders do not follow every proposal, so many DAOs let them delegate their voting power to someone else, often a well-known community member, researcher or organization that publishes its reasoning. Delegation concentrates expertise and raises effective turnout, but it also concentrates power in a few delegates. Holders can usually change their delegate at any time, which keeps some accountability in place.

What DAOs control

In DeFi, DAOs often set the key parameters of a protocol: interest rate models, which assets can be used as collateral, liquidation settings and fees. Many also control a treasury of tokens used to pay developers, auditors and incentive programs. Some DAOs exist for other purposes, such as funding public goods or collecting digital art.

Treasuries

Many DAOs control large treasuries, often holding mostly their own token, along with stablecoins and other assets. They use them to fund development, grants, security audits and incentives. Because a treasury concentrated in the DAO’s own token falls in value when the token falls, many DAOs debate how much to diversify, and whether selling their token to do so would hurt holders. How a DAO manages its treasury says a lot about how sustainable it is.

DAOs outside DeFi

Not every DAO governs a protocol. Some pool money to fund public-goods projects, some collect art or other assets together, and some act as investment clubs or online communities with shared budgets. The tools are similar, voting with tokens and spending through a shared wallet, but the stakes and the legal questions differ with each purpose.

Where DAOs struggle

Concentrated power. Voting by token balance means large holders, including early investors and teams, can decide outcomes.

Low turnout. Many holders never vote, so a small group can pass proposals.

Legal uncertainty. A DAO’s members may face unclear liability, and many DAOs work alongside a foundation or company for legal purposes.

Slow decisions in emergencies, which is why many keep a small group able to pause contracts.

When governance is attacked

On April 17, 2022, an attacker used flash loans of roughly $1 billion, borrowed and repaid within one transaction, to gain about 79% of the voting power in the Beanstalk protocol. They passed a proposal sending its funds to themselves, causing about $182 million in losses. Beanstalk counted voting power at the moment of the vote, not from an earlier snapshot. Many DAOs now count votes from a past block or require tokens to be held for a period before they confer voting power.

The first famous DAO, “The DAO” on Ethereum in 2016, was drained through a code flaw rather than a vote. Our account of the DAO hack tells that story.

Legal structures

Because a DAO is not a company in the traditional sense, its members’ legal position can be unclear, and in some cases courts have treated DAO members as partners with personal liability. Many DAOs therefore operate alongside a foundation or company that can sign contracts, pay contributors and hold intellectual property. Some jurisdictions, including a few US states, have created legal forms designed for DAOs. The arrangement a DAO chooses affects who is responsible if something goes wrong.

Defenses against vote buying

After attacks like Beanstalk’s, many DAOs changed how voting power is counted. Common defenses include taking a snapshot of token balances before a proposal opens, so tokens borrowed afterwards cannot vote, requiring tokens to be held for a period before they count, and delaying execution through timelocks so suspicious proposals can be challenged. These measures make flash-loan takeovers much harder, though they cannot stop a well-funded attacker who buys tokens openly over time.

For a newcomer, the very easiest way to understand a particular DAO is to read its last few successfully passed proposals and the forum threads behind them. They show who actually drives decisions, how contested votes are, how the treasury is being spent and how quickly the community responds when something goes wrong, which says more than any description on the project’s website. Checking how often the same few addresses decide outcomes, and whether proposals from outside the core team ever pass, shows clearly how open the DAO really is in everyday practice.

Questions to ask about a DAO

• Who holds most of the voting tokens?
• How many people vote on a typical proposal?
• Is there a timelock before changes take effect?
• Can a small group pause or upgrade contracts, and who are they?

For the protocols DAOs govern, read what DeFi is and what a smart contract is.

This article is educational content and does not constitute financial, investment, legal or tax advice. Digital assets are volatile and you may lose the amount you invest.

Frequently asked questions

Do I need governance tokens to take part in a DAO?

To vote, usually yes, either directly or by receiving delegated votes. Anyone can typically read proposals and join forum discussions without holding tokens.

Are DAO votes binding?

On-chain votes that trigger smart contracts are binding in the sense that the code carries them out. Off-chain polls are signals that the team or a multisig is expected, but not forced, to follow.

Sources

• Stablecoin Protocol Beanstalk Loses Millions in Attack (flash loan governance exploit; about $182 million per PeckShield) — GovInfoSecurity, April 2022
• Governance Exploits in Disguise (~$1 billion in flash loans; ~79% of voting power) — Ric Shreves
• Governance Attack (snapshot-based voting and holding periods as defenses) — Spark