FAQ
Find answers to common questions about DAO security and how Anticapture works.
+-
What is Anticapture?
Anticapture is a framework turned into a public dashboard that helps DAOs understand and improve their governance security. It works as a risk assessment tool.
Think of it like L2Beat, but focused on governance instead of bridges or rollups. We surface security risks in economic conditions, governance implementation, token distribution and others (read more about Normalcy Bias).
This gives delegates, token holders, investors, foundations, and other contributors a way to understand potential attack risks beyond just smart contract hacks… like what could have happened here.
Think of it like L2Beat, but focused on governance instead of bridges or rollups. We surface security risks in economic conditions, governance implementation, token distribution and others (read more about Normalcy Bias).
This gives delegates, token holders, investors, foundations, and other contributors a way to understand potential attack risks beyond just smart contract hacks… like what could have happened here.
+-
Why do we need something like this?
DAOs and protocols are more vulnerable through governance than most assume. Complexity and normalcy bias make risks invisible even to DAO contributors. Attackers don't have that problem. What they see is an investment opportunity — "How much money should I put into this governance token to have profit, within the rules of the game?"
Surfacing those risks gives builders, stewards, and token holders the clarity they need to act before it's too late.
Surfacing those risks gives builders, stewards, and token holders the clarity they need to act before it's too late.
+-
Why are some DAOs not included?
Some DAOs are still under review, often because their governance model is less conventional or not EVM-based. But our goal is to index them all.
We're Ethereum-first. So we prioritized DAOs, protocols, and L2s that are part of the Ethereum ecosystem. And we are focusing first on the DAOs with that could have the most impact if they were taken over/attacked.
Are we expanding? Yes. We don't want to leave any DAO out of this. Our metrics are evolving, and we'll keep abstracting them to account for more structures without losing clarity.
We're Ethereum-first. So we prioritized DAOs, protocols, and L2s that are part of the Ethereum ecosystem. And we are focusing first on the DAOs with that could have the most impact if they were taken over/attacked.
Are we expanding? Yes. We don't want to leave any DAO out of this. Our metrics are evolving, and we'll keep abstracting them to account for more structures without losing clarity.
+-
Isn't it risky to make DAO vulnerabilities public?
Some DAOs are not comfortable exposing risks, just like certain L2s were uncomfortable with the pressure L2Beat created. That's normal. Our role is to turn raw data into something legible, because transparency without accessibility does not help much.
We want to increase the pressure on DAOs to improve their security before large, well-funded attackers start taking advantage of structural weaknesses.
The game is asymmetric. And no, this public data isn't dangerous. Attackers already know it. What we're doing is leveling the game.
We want to increase the pressure on DAOs to improve their security before large, well-funded attackers start taking advantage of structural weaknesses.
The game is asymmetric. And no, this public data isn't dangerous. Attackers already know it. What we're doing is leveling the game.
+-
What kind of impact has Anticapture had?
We uncovered a major threat to ENS DAO and lead the creation of its Security Council, preventing a potential $150M treasury attack. You can check it here.
We also received a grant from the Uniswap Foundation to conduct a governance security audit for Uniswap DAO — we delivered a security report and integrated the DAO into the dashboard. You can check it here.
Optimism also awarded us a grant to be included in the dashboard. You can check it here.
We also received a grant from the Uniswap Foundation to conduct a governance security audit for Uniswap DAO — we delivered a security report and integrated the DAO into the dashboard. You can check it here.
Optimism also awarded us a grant to be included in the dashboard. You can check it here.
+-
How do the stages work?
We assign DAOs to Stage 0, 1, or 2 based on the risk levels of their governance implementation. A DAO is only as secure as its least secure part, so our stages are assigned based on the most risky aspect a DAO currently has on its implementation.
Those risk levels can be low, medium or high, and are based on elements like voting delays, proposal thresholds, veto powers, flash loan protections, and more. The system helps communities see where they are and what changes are the most urgent for their safety to evolve. Right now it covers mostly Governor Bravo models, but we're already working on broader coverage.
Those risk levels can be low, medium or high, and are based on elements like voting delays, proposal thresholds, veto powers, flash loan protections, and more. The system helps communities see where they are and what changes are the most urgent for their safety to evolve. Right now it covers mostly Governor Bravo models, but we're already working on broader coverage.