DAO Voting Mechanisms: How On-Chain Governance Works

Key Takeaways

• DAO voting governance lets token holders approve or reject changes to a protocol.
• Token-weighted voting is simplest but concentrates power in the largest holders.
• Flash loan attacks and vote buying are real threats that no single design fully solves.
• Timelocks and proposal thresholds, like Compound's, are key defenses worth checking.

What It Is

A decentralized autonomous organization (DAO) is a group that coordinates through rules written in smart contracts rather than through a traditional company structure. Decisions are made by vote, and the votes are usually weighted by a governance token.

DAO voting governance is that decision process: how proposals are created, how votes are counted, what threshold passes a measure, and how the result is executed on-chain. The token holders collectively control parameters, treasury spending, and protocol upgrades.

The appeal is that anyone holding the token can participate, and the outcome executes automatically. The challenge is designing voting rules that are both hard to capture and meaningful enough that people bother to vote.

The Intuition

The default model is token-weighted voting, one token equals one vote. It is simple and matches economic stake to influence, since those with the most at risk get the most say. Most DeFi protocols use it for that simplicity.

The downside is concentration. A large holder, often called a whale, can dominate outcomes alone. Pair that with voter apathy, where most holders never vote, and proposals can pass on a small fraction of total supply. A determined minority with enough tokens can steer the protocol.

Alternative designs try to soften this. Quadratic voting makes each additional vote cost progressively more tokens, amplifying smaller holders relative to whales. Delegation lets holders assign their voting power to a trusted representative, raising participation among those who lack the time or expertise to vote directly. Each fix introduces its own weaknesses.

How DAO Voting Governance Works

A typical on-chain governance flow has stages. A holder with enough tokens submits a proposal. A review and voting period opens. Votes are tallied by smart contract according to the chosen mechanism. If the proposal clears its quorum and majority, it queues in a timelock before execution.

Concrete parameters make this real. In Compound's Governor Bravo, an address needs more than 25,000 COMP delegated to it, roughly 1 percent of supply, to submit a proposal. The quorum is 400,000 COMP, about 4 percent of supply. After a review period and a three-day vote, a passing proposal queues in a timelock and can only execute two days later.

That timelock is a defense, not a formality. It gives the community time to react if a malicious proposal passes. The proposal threshold and quorum are also defenses, since they prevent tiny holders from spamming proposals and require broad support to act.

Quadratic voting carries a different risk. It is vulnerable to Sybil attacks, where one actor splits tokens across many wallets to claim the square-root bonus on each. It only works when paired with a proof-of-personhood system that ties one identity to one voter.

Worked Example

Suppose a DAO uses token-weighted voting with a total supply of 10 million tokens, a quorum of 4 percent, and a passing rule of simple majority of votes cast.

A malicious actor wants to pass a proposal that drains the treasury. Under normal token-weighted rules, they would need to buy a controlling share, which is expensive and visible. Instead, they use a flash loan, borrowing a huge token balance for a single transaction, voting with it, and repaying within the same block.

quorum needed = 10,000,000 * 0.04 = 400,000 votes

If voting weight is read at the instant of the vote, the borrowed tokens count, and the attacker can clear quorum and a majority with capital they never truly owned. The defense is to record voting weight from a snapshot taken before the proposal, so freshly borrowed tokens do not count, combined with a timelock that delays execution long enough for the community to respond. Compound's two-day timelock and snapshot-based weighting exist precisely to blunt this attack.

Common Mistakes

1. Assuming one token, one vote is democratic. Token-weighted voting concentrates power in whales. A handful of large holders can control outcomes regardless of how many small holders disagree.

2. Ignoring quorum and turnout. Low participation means proposals can pass on a small slice of supply. A measure approved by 4 percent of tokens is not the same as broad consensus.

3. Overlooking flash loan attack risk. If voting weight is read live rather than from a prior snapshot, an attacker can borrow tokens, vote, and repay in one transaction. Snapshot timing matters.

4. Believing quadratic voting solves everything. Quadratic voting reduces whale dominance but invites Sybil attacks. Without proof-of-personhood, an attacker splits tokens across wallets to game the formula.

5. Skipping the timelock check. A protocol without an execution delay can be drained the instant a malicious proposal passes. The presence and length of a timelock is a basic safety signal.

Frequently Asked Questions

What is DAO voting governance in simple terms? It is how a decentralized organization makes decisions, usually by letting token holders vote on proposals to change the protocol. The votes are counted by smart contract, and passing proposals execute automatically.

How does DAO voting governance affect investment decisions? Governance controls treasury spending, fees, and upgrades, so the voting design shapes how a protocol's value can change. A token where a few whales control every vote carries different risk than one with broad, active participation and strong defenses.

What is a real-world example of DAO voting? In Compound's governance, an address needs more than 25,000 COMP delegated to propose a change, a quorum of 400,000 COMP must vote in favor, and a passing proposal waits in a two-day timelock before it executes. These parameters are published in the protocol's documentation.

How can DAOs defend against governance attacks? Recording voting weight from a snapshot before the proposal blocks flash loan attacks, and a timelock delays execution so the community can react. For quadratic systems, pairing votes with a proof-of-personhood check limits Sybil attacks.

How is DAO voting different from corporate shareholder voting? Both weight votes by ownership, but DAO votes execute automatically on-chain and tokens trade freely, so voting power can be borrowed or assembled quickly. Corporate voting runs through proxies, record dates, and legal structures that move far more slowly.

Sources

1. Compound v2 Documentation. "Governance." https://docs.compound.finance/v2/governance/
2. Chainlink. "Governance Tokens: How DAO Voting Works." https://chain.link/article/governance-tokens-dao-voting
3. arXiv. "Balancing Security and Liquidity: A Time-Weighted Snapshot Framework for DAO Governance Voting." https://arxiv.org/html/2505.00888v2
4. Blockchain Council. "DAO Governance Models: Token Voting, Reputation Systems, Quadratic Voting." https://www.blockchain-council.org/dao/dao-governance-models-token-voting-reputation-systems-quadratic-voting/

Disclaimer

This article is educational content only and is not financial advice. Nothing here is a recommendation to buy, sell, or hold any security. Consult a licensed advisor before making investment decisions.