DAOs Face Trade‑off Between Automated Code and Emergency Controls

Compound, a crypto lending platform governed by a DAO of COMP token holders, nearly approved a $24 million token transfer in July 2024 after a last‑minute surge of votes. The proposal passed despite no code malfunction, exposing a gap: the protocol lacked a mechanism to pause or veto decisions once voting power consolidated.

What happened at Compound

Proposal 289 sought to move 499,000 COMP into a yield‑bearing vehicle controlled by a small group of voters. In the final 34 minutes, supporting addresses cast 563,591 votes—about 82 % of total support—pushing the measure past the required margin (682,191 vs 633,636). After the vote, Compound settled by canceling the allocation and adding a veto role to its governance framework.

Research on DAO vulnerabilities

Two 2026 studies of 48 large Ethereum DAOs found similar structural risks. One study examined how registration, staking, and delegation concentrate voting power; the other mapped attacks that exploit legitimate governance rules. Key observations include:

• Only 21 % of token supply was typically registered to vote, leaving the majority in exchange or DeFi contract wallets.
• Fourteen DAOs had intermediary wallets controlling more tokens than the entire registered electorate.
• Delegation and staking create durable voting blocs; the ten largest holders controlled over 50 % of voting power in 39 of the 48 DAOs.

Common governance mechanisms

DAOs employ various gates to manage proposals and voting:

1. Registration – requires wallet sign‑up, token lock‑up, or minimum balances.
2. Staking – locks a portion of tokens, often with withdrawal delays, to make attacks costlier.
3. Delegation – lets token holders assign voting power to a delegate, concentrating influence.

Each gate mitigates certain threats but also favors participants with capital, technical expertise, or custodial control.

Potential safeguards

Researchers suggest that protocols could mitigate late‑vote attacks by:

• Extending voting periods when large vote spikes occur near deadlines.
• Requiring longer staking periods before votes count.
• Introducing an emergency council or veto authority.

Implementing any of these measures shifts power toward reactive voters, locked‑token holders, or a small emergency body, illustrating the inherent trade‑off between pure code execution and human oversight.

Broader implications

The Compound case is not isolated. Similar exposure was identified in Uniswap, Radicle, Gitcoin, Silo, Ampleforth, Hop, and Cryptex as of 2024. Effective DAO governance assessments should therefore go beyond token distribution to include:

• Share of supply eligible to vote.
• Concentration of voting power among top delegates.
• Roles that can introduce, execute, or veto proposals.

While smart‑contract audits verify code correctness, a “constitutional audit” would evaluate where authority ultimately resides.