The pitch for a DAO is easy to summarize: instead of a board of directors deciding what a protocol does with its money, token holders vote, and a smart contract executes whatever wins. No registered agent, no quarterly meeting, no CEO. A decentralized autonomous organization is supposed to be governance reduced to arithmetic.
The arithmetic is the interesting part, because it's public. Every proposal, every vote, every wallet that cast one sits on-chain where anyone can count it. And when researchers do count it, the picture that emerges looks less like a town hall and more like a very small room with very good acoustics.
Turnout is the first thing that breaks
Participation in DAO voting is dismal by any standard you'd apply to a shareholder meeting or a municipal election. Across most major DAOs, fewer than 2% of eligible token holders vote on a typical proposal, and 10% turnout is treated as a notably good result. Uniswap's DAO, one of the largest and most closely watched in the space, routinely sees turnout below 3% on routine governance items.
This is not necessarily irrational behavior. Voting on-chain costs gas. Reading a proposal that modifies a lending protocol's interest rate curve takes real expertise. If you hold 400 tokens out of a 100 million token supply, the expected value of your effort rounds to zero. Rational apathy is a well-documented feature of dispersed ownership in traditional corporate governance too; tokens didn't invent it, they just made it legible.
The consequence is that a small, engaged minority decides outcomes. In the ApeCoin DAO, a single wallet holding roughly 4% of supply was enough to block a $1 million grant. That is not a bug in the vote-counting code. It's what token-weighted voting does when 98% of the tokens stay home.
Delegation moves the concentration, it doesn't remove it
Most large DAOs responded to low turnout with delegation: you assign your voting power to someone who promises to show up and read the proposals. This genuinely improves effective participation. It also produces a new concentration problem. Across major DAOs, the top ten delegates typically control somewhere between 30% and 60% of voting power. The pool of people who actually decide things shrinks to a recognizable, repeat cast.
When a large holder wants something, the math is straightforward. In 2024, a Compound Finance whale operating under the name "Humpy" put forward a proposal to move 499,000 COMP — roughly $24 million, about 5% of the protocol's treasury — into a yield product run by a group he led. It narrowly passed. Nothing was hacked. The governance system worked exactly as designed, which was the complaint.
Newer designs try to blunt this. Quadratic voting, where the cost of additional votes rises with the square of the votes cast, has been adopted by a handful of prominent DAOs including Gitcoin and Optimism. Hybrid models pair on-chain voting with off-chain deliberation forums and elected expert committees. Each of these trades some decentralization for some resistance to capture, and reasonable people disagree about where that line belongs.
A proposal is executable code, not a sentence
The most under-appreciated risk in DAO governance is that voters are not approving an English description. They're approving an array of contract calls. A Governor-style proposal looks roughly like this:
governor.propose(
[treasury.address], // targets — contracts to call
[0], // ETH value sent with each call
["transfer(address,uint256)"], // function signatures
[encodedArgs], // ABI-encoded arguments
"Fund the Q4 security audit", // human-readable description
);The last argument is the only part most voters read. The first four are what executes.
Tornado Cash learned this expensively in 2023. An attacker submitted a proposal that looked routine, then used a CREATE2 and selfdestruct trick to swap out the deployed contract's bytecode after the vote passed but before execution. The replacement code granted the attacker roughly 1.2 million votes — more than the entire legitimate voting supply — handing them unilateral control of the DAO. Auditing a proposal at submission time was not enough, because the code at the address changed underneath it.
The defenses that emerged are unglamorous: execution timelocks that leave a window to notice and cancel, refusing to pass proposals that point at unverified contracts, and verifying bytecode at execution rather than at approval. L2BEAT researchers flagged a later Tornado Cash proposal on exactly that signal — it referenced an unverified contract, which for that DAO was anomalous enough to treat as hostile.
The legal layer showing up late
The other development worth tracking is that DAOs have started acquiring legal form. Wyoming's Decentralized Unincorporated Nonprofit Association — the DUNA — is a statutory entity built for this case. It requires at least 100 members and blockchain-based governance, and in exchange it gives participants limited liability and gives the organization the ability to sign contracts, hold assets, and pay taxes in its own name, all without the corporate formalities that would defeat the point. Uniswap Governance and Nouns DAO are among the organizations that have adopted it, and current drafts of the CLARITY Act treat the DUNA as the recognized structure for decentralized governance.
That matters because the original framing — a DAO as an organization with no legal surface area — was never accurate. Without a wrapper, members of an unincorporated association can be exposed to joint liability for what the group does. The wrapper doesn't make the governance better. It makes the consequences of the governance land somewhere defined.
If you want to evaluate a DAO rather than take its description at face value, the public data makes it unusually easy: pull the last twenty proposals, look at the turnout percentage, look at how much of the winning side came from the top five addresses, and check whether there's a timelock between passage and execution. Those three numbers will tell you more about how the thing is actually governed than the documentation will.