Panel

Alerts

Contact

Donate

Glossary

FAQ

DAO Overview

Risk Analysis

Resilience Stages

Token Distribution

Holders & Delegates

Activity Feed

Panel

Alerts

Contact

Donate

Glossary

FAQ

Panel

Get Security Alerts

>v1.1.0_

powered by

Blockful
Docs

/

Terms of Service

/

Give Feedback
Docs

/

Terms of Service

/

Give Feedback

/

Risk Analysis

Risk level:

HIGH

Assess critical vulnerabilities in the DAO's governance setup.

Risk level:

HIGH

Risk Areas

Each item highlights a specific risk area, showing which issues are resolved and which still expose the system to threats.

SPAM VULNERABLE
ATTACK PROFITABILITY
SAFEGUARDS
HACKABLE
RESPONSE TIME
GOV FRONT-END VULNERABILITY

Spam Vulnerable

HIGH

Means the system can be overwhelmed by malicious or low-quality proposals. This wastes resources, discourages real participation and exposes the DAO to a war of attrition.

It usually happens when there are no checks to submit proposals, or the implementation allows it to be ignored.

// REQUIREMENTS

  • Proposal Flashloan Protection
  • Proposal Threshold
  • Spam Resistance
  • Voting Flashloan Protection
  • Voting Period
  • Voting Subsidy

Governance Implementation

When combined, these requirements determine the risk level of each area above. Here, you can explore each one individually and see why it's considered high risk—or not.

+-

Attack Profitability

~$500k

HIGH

Definition

Compares the cost of all delegated votes with the value of assets in the DAO treasury excluding its governance tokens.

Risk explained

The liquid treasury of the DAO is ~$500k bigger than its current delegated supply.

+-

Proposal Threshold

150k GTC

HIGH

Definition

The minimum number of votes required to create a proposal.

Risk explained

The proposal threshold is 150k GTC, which is the minimum amount of GTC required to propose a new proposal. The level of risk of this depends on the liquidity on markets.

+-

Proposal Threshold Cancel

No

HIGH

Definition

Whether a proposal may be canceled if the wallet that submitted it no longer has the number of governance tokens required to reach the proposal threshold.

Risk explained

Currently an attacker can propose by holding enough tokens, dump them on the market and the proposal would stay valid.

+-

Spam Resistance

No

HIGH

Definition

Protection against an attacker submitting several proposals at once to trick the organization's members into approving a malicious proposal.

Risk explained

Currently, an attacker can submit multiple proposals and cause a war of attrition against defending delegates.

+-

Voting Subsidy

No

HIGH

Definition

The DAO sponsoring the gas costs of voting for its members allowing them to essentially 'vote for free'.

Risk explained

The voting subsidy is not applied, requiring delegates to pay gas on the proposals they vote on.

+-

Interface Hijack

No

MEDIUM

Definition

Protection against Domain Name Service attacks on the domains/websites used by the DAO.

Risk explained

The DAO's domains have no publicly verifiable DNS-level protections we are aware of.

+-

Vote Mutability

No

MEDIUM

Definition

The governance contract accepts changes to votes even after they have been cast on-chain.

Risk explained

In case of an exploit that affects the voting platforms, immutable votes can leave delegates stuck with a incorrect vote made in a compromised interface.

+-

Voting Delay

44 hours

MEDIUM

Definition

Waiting period between proposal submission and the snapshot to count for voting power and start the votes.

Risk explained

With less than 2 days of voting delay, token holders might miss the chance to delegate in support of the DAOs defense

+-

Voting Period

5 days and 14 hours

MEDIUM

Definition

Period in which wallets with governance tokens or delegates have the opportunity to vote on proposals submitted to governance.

Risk explained

The voting period is 5 days and 14 hours, with the recommended safety being of 7 or more for a low level of risk.

+-

Audited Contracts

Yes

LOW

Definition

The governance contract codes have been audited and approved by a security provider.

Risk explained

The contracts have been audited for smart contract security.

+-

Proposal Flashloan Protection

Yes

LOW

Definition

Protects the DAO from users creating a proposal using voting power from borrowed tokens via flash loan.

Risk explained

The DAO is not vulnerable to proposal flashloan attacks.

+-

Timelock Admin

No

LOW

Definition

Controls whether governor's administration can be transferred or shared with addresses other than the DAO itself.

Risk explained

There's no external entity with control to the timelock roles.

+-

Timelock Delay

2 days

LOW

Definition

Waiting period to execute a proposal after it's approved. Aims to prevent the automatic execution of a malicious proposal that negatively affects the DAO.

Risk explained

The timelock delay of two days gives time for the DAO to respond before execution.

+-

Veto Strategy

No

LOW

Definition

Allows governance members to cancel a proposal submitted to the DAO after it has been submitted/approved.

Risk explained

The DAO has no veto strategy.

+-

Voting Flashloan Protection

Yes

LOW

Definition

Protects the DAO from users manipulating votes using voting power from borrowed tokens via flash loan.

Risk explained

Delegates voting power are based on its delegation on block previous to when they could first cast a vote, making flashloan votes impossible.

+-

Security Council

No

NONE

Definition

Group of people responsible for taking action to increase the DAO's security against harmful proposals through a multisig administered by them.

Risk explained

The DAO has no security council.