Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SoK: Attacks on DAOs

Rainer Feichtinger, Robin Fritsch, Lioba Heimbach, Yann Vonlanthen, Roger Wattenhofer

TL;DR

This paper addresses security threats to DAO governance by introducing a four-vector taxonomy (BR, TC, HCI, CP) and applying it to 28 real-world incidents across multiple blockchains, complemented by audits and an empirical study of 26 DAOs. It reveals that governance attacks arise from both on-chain code and off-chain human/economic dynamics, with audits disproportionately focusing on CP vulnerabilities. The authors identify seven risk factors (RF1–RF7) and quantify susceptibility across a diverse set of DAOs, showing that smaller projects are often more exposed. Finally, the paper proposes a broad set of mitigations—from conservative implementation to authentication and privacy tools—to deter attacks and guide the development of more robust governance frameworks.

Abstract

Decentralized Autonomous Organizations (DAOs) are blockchain-based organizations that facilitate decentralized governance. Today, DAOs not only hold billions of dollars in their treasury but also govern many of the most popular Decentralized Finance (DeFi) protocols. This paper systematically analyses security threats to DAOs, focusing on the types of attacks they face. We study attacks on DAOs that took place in the past, attacks that have been theorized to be possible, and potential attacks that were uncovered and prevented in audits. For each of these (potential) attacks, we describe and categorize the attack vectors utilized into four categories. This reveals that while many attacks on DAOs take advantage of the less tangible and more complex human nature involved in governance, audits tend to focus on code and protocol vulnerabilities. Thus, additionally, the paper examines empirical data on DAO vulnerabilities, outlines risk factors contributing to these attacks, and suggests mitigation strategies to safeguard against such vulnerabilities.

SoK: Attacks on DAOs

TL;DR

This paper addresses security threats to DAO governance by introducing a four-vector taxonomy (BR, TC, HCI, CP) and applying it to 28 real-world incidents across multiple blockchains, complemented by audits and an empirical study of 26 DAOs. It reveals that governance attacks arise from both on-chain code and off-chain human/economic dynamics, with audits disproportionately focusing on CP vulnerabilities. The authors identify seven risk factors (RF1–RF7) and quantify susceptibility across a diverse set of DAOs, showing that smaller projects are often more exposed. Finally, the paper proposes a broad set of mitigations—from conservative implementation to authentication and privacy tools—to deter attacks and guide the development of more robust governance frameworks.

Abstract

Decentralized Autonomous Organizations (DAOs) are blockchain-based organizations that facilitate decentralized governance. Today, DAOs not only hold billions of dollars in their treasury but also govern many of the most popular Decentralized Finance (DeFi) protocols. This paper systematically analyses security threats to DAOs, focusing on the types of attacks they face. We study attacks on DAOs that took place in the past, attacks that have been theorized to be possible, and potential attacks that were uncovered and prevented in audits. For each of these (potential) attacks, we describe and categorize the attack vectors utilized into four categories. This reveals that while many attacks on DAOs take advantage of the less tangible and more complex human nature involved in governance, audits tend to focus on code and protocol vulnerabilities. Thus, additionally, the paper examines empirical data on DAO vulnerabilities, outlines risk factors contributing to these attacks, and suggests mitigation strategies to safeguard against such vulnerabilities.
Paper Structure (15 sections, 3 figures, 2 tables)

This paper contains 15 sections, 3 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Categorization of Attack Vectors
  4. Bribing
  5. Token Control
  6. Human-Computer Interaction
  7. Code & Protocol Vulnerability
  8. Real-World Incidents & Attacks
  9. Risk Factors
  10. Mitigation and Safeguards
  11. Related Work
  12. Conclusion
  13. Analyzed Incidents, Attacks & Audits
  14. Data Collection
  15. Paladin Lending

Figures (3)

  • Figure 1: Comparison of treasury values and the total value of all delegated governance tokens. If the value of the treasury (yellow line) or even the value of the treasury without the governance token (red line) exceeds the value of delegate votes (blue line) this represents an economic risk.
  • Figure 2: Number of holders, i.e. EAOs, who hold more tokens than delegated governance votes on a monthly basis. These holders would have the majority of the delegated votes after they delegate their tokens.
  • Figure 3: Amount of liquidity available on Paladin in relation to the proposal threshold of the respective protocol.

Theorems & Definitions (4)

  • Definition
  • Definition
  • Definition
  • Definition