[RFC] Preparing for possible Governance Attacks

Requests for Comment
1

Summary

Kickstart a discussion around preparing the DAO for possible governance attacks.

Motivation

In 2023, several major DAOs faced governance crises due to attacks that exploited weaknesses in their treasury management. Nouns DAO encountered an incident when investor DCF GOD and allies amassed enough NFTs to propose liquidating the treasury. Amidst a bear market and disagreements over spending priorities, they used the governance structure for personal gain, withdrawing $27 million from the treasury.

Similarly, Aragon DAO experienced a governance exploit in May 2023. Investors gained control of 51% of the token supply and proposed liquidating the treasury. Despite efforts to oppose the move, they extracted $163 million, which led to Aragon’s dissolution.

Most recently, in 2024, Compound DAO suffered a governance attack by a group known as the “Golden Boys.” They exploited the governance process to pass a proposal transferring $24 million in COMP tokens to a protocol under their control. This attack succeeded due to several factors: low voter turnout, poor timing of the vote (during a weekend), and lack of transparency.

These cases highlight a critical vulnerability in DAOs—concentrated voting power and low voter engagement can lead to malicious actors seizing governance control and draining the treasury for personal gain.

Rationale

Uniswap DAO’s core mission is to govern its protocol and manage treasury resources to support its long-term objectives. However, as the DAO grows, its treasury expands, creating an attractive target for potential attacks.

The current dynamic poses a threat: while the value of the treasury increases, the percentage of tokens actively delegated for governance decreases. This creates an imbalance where an attacker could acquire enough $UNI to take control of the DAO at a cost far below the total value of the treasury. Without safeguards, Uniswap DAO is at risk of facing a similar governance attack.

Implementation

We see two possible solutions to address this challenge:

  1. Establish a Veto Council

One proposed solution to safeguard the DAO’s treasury is to create a Veto Council. This council would have the authority to veto any proposal deemed harmful to the DAO. However, to avoid centralisation risks, the council’s veto power would be limited—lasting only 18 months. This ensures the council’s role is temporary, allowing time to strengthen governance while minimising the risk of long-term centralisation.

The Veto Council would provide an immediate defence mechanism, intervening when malicious proposals threaten the DAO’s stability or treasury. The ENS DAO recently adopted a similar solution (link).

  1. Introduce Proposal Staking

An alternative solution is to implement a staking requirement for proposal authors. Under this system, anyone submitting a proposal must stake a small amount of UNI tokens, which would be locked until the vote concluded. Additionally, the vote would include a default option to cancel the proposal and slash the author if it receives over 33% of the votes to veto the proposal. This would effectively discourage bad actors from submitting harmful proposals, as they risk losing their staked tokens. The Cosmos hub governance has successfully implemented the ‘’No with Veto’’ option to combat spam and malicious proposals and has achieved tremendous success. This approach, however, can only be implemented in matured DAOs in terms of governance processes as an irrational stakeholder(s) with 33% of the voting power could exploit the system and veto any proposal and slash an innocent participant.

Benefits:

  • Unlike the Veto Council, which introduces some level of centralisation, proposal staking preserves the DAO’s decentralised nature. It empowers the broader delegate community to assess and vote on the validity of proposals, ensuring the process remains transparent and democratic.

  • By adding financial risk to submitting proposals, the staking mechanism discourages malicious intent while encouraging more thoughtful, well-constructed proposals.

  • No with Veto could be used by minor delegates to convey their strong disagreement with a particular proposal.

Next Steps

  • Gather consensus from the DAO about next steps.

Voting Options

  • Establish a Veto council
  • Explore Proposal staking
  • Make no changes
  • Other
4 Likes
2

In the long run there may be some concerns around the legal responsibility of security council dynamics. It’s very easy to imagine a world where a DAO’s security council (or in this case, Veto council) is deemed legally responsible for the rest of the DAO, and so we’re a bit wary of this option.

The best solution in face of regulatory uncertainty may be to look for more implicit voting dynamics that make governance attacks more difficult. Thus, we’d like to see further exploration of the proposal staking method. A couple immediate thoughts:

  1. Is there any situation where the DAO could find itself “bricked”, as in unable to push any more votes because of a new hostage situation?

  2. The other possible problem for proposal staking is that a non-malicious controversial proposal could still be slashed. While we don’t think that people will go about slashing proposals they don’t like, it’s a possibility.

Still, generally speaking, we’re in favor of the latter, though how would this be enforced operationally? This cannot be done on Snapshot, so there would have to be a specific Tally integration for this to be possible.

Ultimately, this all falls back onto voting dynamics. Compound’s problem was that it had some very large delegates that were inactive, and while incentive programs are great for maintaining participation among key delegates, there will be ways to usurp those programs as well. Thinking aloud here, but maybe we should rethink participation in the DAO, as in have some fall back system for which non-voting delegates can have voting power redistributed upon a certain participation threshold. This wouldn’t be forceful with their own voting power, only voting power delegated to them from other parties.

3 Likes
3

While it’s important that the DAO keeps governance security top of mind, implementing safeguards such as a guardian are very much circumstantial. As of today, Uniswap is in a much stronger position than most other DAOs. Voter apathy at the onchain level is not a significant problem either. There has not been a proposal that failed to pass due to voter apathy in the past, and scarcely does this occur even at the offchain level. I think the last time an offchain proposal failed snapshot due to apathy was over a year ago. Delegates are getting paid. Plus the treasury delegates votes, too. The economic value for onchain quorum is high (relative to other DAOs). Proposal threshold is also high. And there are measures like a timelock delay that inherently increase the risk for a proposer to drain the treasury. Plus, unlike Compound, there aren’t user funds at risk. Uniswap DAO only has jurisdiction over so many functions.

I would suggest keeping a keen eye on existing parameters as opposed to introducing alternative vectors that increase risk surface area in other ways. For instance, the proposal threshold today is 1M UNI, and the timelock delay is like 2 days. Increasing the the proposal threshold and the timelock delay collectively make it more difficult for a drain to occur since the attacker is essentially holding on to a lump of sand; a longer delay period allows the market to dump the native token, and a higher proposal threshold would make the economic cost of posting that proposal more expensive since the value of, say that 1M UNI, would be falling in that timelock delay phase.

This topic should be carefully visited over time though, especially if the treasury aims to diversify. In the treasury working group research draft we mention this concern:

"
Beyond altering the fee switch function, Uniswap governance importantly has the ability to withdraw UNI tokens from the treasury. As of today, since the treasury is entirely consistent of native tokens, the financial benefit for an attacker is uncertain. The mere cost of swaying, either through direct purchase or bribes, votes towards draining the treasury is simply too high at the moment, with a 40M UNI quorum currently standing at $240M (@ $6 per UNI). Enough time can also elapse before the native token devalues to nearly zero if a governance attack were to occur. The 2+ day timelock delay, for instance, allows for existing token holders to liquidate their holdings, making it increasingly expensive for an attacker to continue holding UNI. However, as the DAO’s treasury diversifies into non-native assets, the value of the treasury becomes increasingly appealing for malicious actors. It is therefore imperative for treasury diversification initiatives to coincide with consistent improvements in governance security.

To effectively manage the growing complexity of DAO security as treasuries become more valuable and diversified, governance parameters should be reviewed regularly by delegates. Malicious actors take advantage of stale or inadequate voting thresholds, low participation rates, or concentrated voting power. Therefore, vigilance in updating governance mechanisms is critical to mitigating risks. This is especially important if the native token sustains its lack of utility and value accrual for it may increase price suppression as well as likelihood of frustrated UNI holders accepting bribes.

In a scenario where a fee switch is not active and the treasury is increasing its non-native token holdings, the DAO can, for instance, increase its quorum level to accommodate for the likelihood of an attack. Programs such as delegation using the treasury’s native tokens is another method for allocating votes to community-trusted entities. If the non-native token value of the treasury exceeds the total value of delegated votes, a metric that ideally needs to be adjusted based on average voter participation rate, the expected value of a treasury drain increases. As per the below graph, this has never been an issue for Uniswap—but must be considered once treasury diversification offers.

Treasury tokens can also be allocated toward rewarding consistent voting, participation in governance proposals, or for attracting new delegates. Voter engagement must be seen as a critical expenditure item, directly linked to the long-term security of the DAO’s treasury.

If voter apathy is unchecked, the barriers to passing malicious proposals will diminish. Therefore, incentivizing governance is not merely a budget item—it is a safeguard against treasury vulnerabilities. For these reasons, the Uniswap DAO has been allocating incentives to socially-responsible delegates since June 2024, and we forecast such programs to remain present for the foreseeable future. A lack of a circuit breaker for malicious votes via a guardian or emergency shutdown mechanisms—like those in MakerDAO—only increases the need for active delegates to monitor parameters and protect the treasury.
"

3 Likes
4

On behalf of ScopeLift, I’m against the introduction of a Veto Council. Such a measure is extremely centralizing and should be looked at as a last ditch, temporary solutio. While some DAOs are in fact facing such a situation now, and while many more (including eventually Uniswap) will face it in the future if we don’t take proper steps to align and incentivize token holders and delegates, it is currently not the case.

I’m open to the idea of proposal staking, and other DAOs are experimenting with this (notably ENS), however such a solution is ultimately just a speedbump for a serious attacker. Any bond requirement placed upon proposers would be much less than what a genuine attacker would be able to gain should they take control of Governance.

For now, Uniswap DAO is secure, and should not accept a centralizing, risky hack. Instead we should focus on sustainable long term solutions, like delegate compensation, UniStaker adoption, and governance minimization.

2 Likes
5

My question is whether the real issue is structural, mechanics, or procedural?

Question of Procedural guardrails

Exactly what proposals get listed for voting and subsequent execution? I would think there are checks and balances for

  1. Normal/Routine - threshold (eg less than XYZ), within previous scope, passed temp check
  2. Exemption - something which breaks the norms but may require special consideration, longer debate or emergency consideration
  3. Exception - things which are significant or structural. I’d note that investors have to have mechanism for rage-quitting … There may be penalties involved for early withdrawal but it should be clear at start what pooling the funds and whether there are legal restrictions

Issue of Mechanics

At the moment the distribution of tokens acts as a functional electoral college (cf HK). But you can have alternatives to Roman voting (yes/no) … For example Kiwi voting using the loom.io approach allows for yes/no/veto/abstain with rules on what a veto does (strong objection as against some policy). Greek voting allows for contentious but popular decisions to be considered by an expert panel. And of course the various web3 attempts like conviction voting (the proposal that timelocked the longest has greater weight) or holographic voting. These all fall under decision science mechanism design and can be assessed rationally (and not argument by analogy). Aragon sought external investment and when the punters saw nothing being done, they got sick of waiting, hence rage-quit so the context is different.

Structural

If you create new pre-emptive rights or even allow layers of ratification (a la intercession by courts/trust protectors) it alters the balance of power … This may be deliberate but should not be casually done.

Delegation != Abdication … If you wish to “donate” funds to a cause, then make sure someone keeps an eye on any adverse 51%yakuzi style “proposals” https://en.m.wikipedia.org/wiki/Sōkaiya

6

Thank you @jengajojo for proposing measures regarding the very important issue of governance attacks.

We think that, considering the current state of the Uniswap DAO, the two options currently proposed change the voting dynamics too much.

First, regarding establishing a Veto Council, we believe that giving such strong power to certain DAO participants affects other participants too significantly. We assume that if a rigorous selection is made from the delegates currently participating in the DAO, honest members will be chosen. However, we are concerned that the power balance between the selected and unselected delegates may lower the health of the DAO. Even if the selected members cannot abuse their power, there is a risk that other participants might hesitate to voice strong opinions to members who can reject on-chain votes or become overly compliant with their views.

Next, we think that introducing Proposal Staking is a milder measure than the above method, but we have two concerns. First, we doubt whether staking a small amount of UNI can effectively prevent governance attacks in advance. We couldn’t envision a situation where staking a small amount of UNI would deter attackers when targeting a very large DAO like Uniswap. Second, the potential limitation of proposal creators due to the introduction of this system; after this system is implemented, delegates with low VP may find it difficult to create on-chain votes, possibly leading to an increase in instances where they have to ask larger delegates to create on-chain votes on their behalf. This could accelerate the power gradient, similar to our concerns with establishing a Veto Council, and lead to the unhealthiness of the DAO.

We believe that instead of such major system changes, we should first implement simple measures that can strengthen governance. For example, increasing the quorum of on-chain voting or extending the time-lock period. Although these changes might introduce significant alterations to the contract, they would have less impact on the DAO’s dynamics and may allow for measures without lowering the health of the DAO.

7

Thank you @BlockworksResearch @drllau_LexDAO @Tane @AbdullahUmar @bendi for the thoughtful feedback and insights. It’s clear that governance security is a top priority, but opinions differ on the right approach. Here are the common themes we have identified from the discussion:

  • Most commenters agree that a Veto Council could centralise power and disrupt the balance between delegates, making it a last-resort solution rather than a first step.

  • Many are open to Proposal Staking, but there are concerns that staking a small amount of UNI won’t effectively deter serious attackers, and that it could discourage smaller delegates from participating.

  • Several commenters prefer smaller, incremental changes, such as increasing the quorum or extending the time-lock period, strengthening governance without drastically altering the current structure.

Suggested Action Items:

  • Given the strong concerns about centralisation, it seems best not to pursue this option at the moment.

  • While it’s seen as a ‘speedbump’, further exploration of Proposal Staking is warranted. We can explore adding the functionality of the ProposalBond to the UNI Governor that would allow a proposer to propose with a lower threshold, and then the community could vote [For, Against, Veto and slash,Abstain]. If the weight of VetoandSlash > Against, then the proposer does not get their bond back and the proposal does not pass.

  • There seems to be support for increasing the quorum and extending the time-lock period as simpler, effective measures to protect against governance attacks we shall explore bringing these proposals to the DAO.

  • Regularly reviewing and updating governance mechanisms, particularly as the treasury diversifies, should be prioritised to stay ahead of potential risks.

What do you all think?

2 Likes
8

Valuable conversation here, thanks for getting it going @jengajojo. The UF recently gave a grant to a team to do a governance audit. The output will be a description of the current risk vectors, strategies for risk mitigation, and a dashboard to monitor the on-chain drivers of risk. I’d suggest waiting for those results before introducing any proposals to change our governance structure.

4 Likes
9

Is the any particular reason why you forsee a governance attack in the next 18 months specifically?
To me it seems that the centralization risks outweight the pros.

1 Like
10

Really great to see this discussion happening thanks @jengajojo

We certainly agree that now more than ever, governance attacks are becoming more credible and DAOs should be doing more to protect against such attack vectors.

We echo a lot of the same thoughts highlighted by other comments and delegates and will focus our attention on your response:

We are not convinced that Proposal Staking will significantly deter an attacker and it ultimately creates more friction for regular day-to-day governance. The Proposal Bond would need to be sufficiently large enough to drastically reduce the profit of an economic attack, it is simply just an additional cost to the attacker (assuming they are very confident they can pass the proposal). By having a lower proposal threshold to make it easier for delegates, we are reducing this cost. Furthermore, it also requires proposers/delegates to hold a notable amount of UNI to put up as a bond which is not ideal (assuming you slash from a bond and not delegated VP)

Increasing the Quorum should be explored and we look forward to the analysis that the UF has funded as mentioned by @eek637. Looking at all non-cancelled onchain proposals below, our initial thoughts are that there is some room to increase it, however, this should be combined with efforts to further increase delegated UNI VP as we don’t want to end up in a situation where it’s extremely difficult to pass proposals.

image
image1128×1034 24.8 KB

Regarding increasing the time lock, we are unsure of its efficacy. In most cases, Timelocks were created to allow for Veto Councils to intervene and/or allow users of the relevant protocol to exit the system if they do not agree with the changes. In Uniswap’s case, governance is largely minimised and doesn’t really affect users. Increasing the Timelock delay also delays the DAO’s ability to respond to any bugs or exploits across relevant gov controlled contracts. Lastly, it could be fair to assume that an attacker could be hedging their position (buying spot, selling perps) in which a declining UNI price is not as important as it seems. In this case, an attacker’s costs are likely the funding rate and slippage to enter + exit their position.

3 Likes