Panel

Alerts

Contact

Donate

Glossary

FAQ

DAO Overview

Risk Analysis

Resilience Stages

Token Distribution

Holders & Delegates

Panel

Alerts

Contact

Donate

Glossary

FAQ

Panel

Get Security Alerts

>v1.1.0_

powered by

Blockful
Docs

/

Terms of Service

/

Give Feedback
Docs

/

Terms of Service

/

Give Feedback

/

Risk Analysis

Risk level:

HIGH

Assess critical vulnerabilities in the DAO's governance setup.

Risk level:

HIGH

Risk Areas

Each item highlights a specific risk area, showing which issues are resolved and which still expose the system to threats.

SPAM VULNERABLE
ATTACK PROFITABILITY
SAFEGUARDS
HACKABLE
RESPONSE TIME
GOV FRONT-END VULNERABILITY

Spam Vulnerable

HIGH

Means the system can be overwhelmed by malicious or low-quality proposals. This wastes resources, discourages real participation and exposes the DAO to a war of attrition.

It usually happens when there are no checks to submit proposals, or the implementation allows it to be ignored.

// REQUIREMENTS

  • Proposal Flashloan Protection
  • Proposal Threshold
  • Spam Resistance
  • Voting Flashloan Protection
  • Voting Period
  • Voting Subsidy

Governance Implementation

When combined, these requirements determine the risk level of each area above. Here, you can explore each one individually and see why it's considered high risk—or not.

+-

Audited Contracts

No

HIGH

Definition

The governance contract codes have been audited and approved by a security provider.

Risk explained

Governance contracts are not audited, or not publicly disclosed.

+-

Interface Hijack

Insufficient Protections

HIGH

Definition

Protection against Domain Name Service attacks on the domains/websites used by the DAO.

Risk explained

While a domain can function without a CAA record, but it is less secure because any certificate authority (CA) can issue certificates for that domain, creating a risk of fraudulent certificates, impersonation, and man-in-the-middle attacks.

+-

Proposal Threshold

30K $OBOL (0.006% Total Supply)

HIGH

Definition

The minimum number of votes required to create a proposal.

Risk explained

The proposal threshold is less than 1% of the active market supply of $OBOL.

+-

Proposal Threshold Cancel

No

HIGH

Definition

Whether a proposal may be canceled if the wallet that submitted it no longer has the number of governance tokens required to reach the proposal threshold.

Risk explained

Once a proposal is submitted, the proposer can immediately dump their tokens, reducing their financial risk in case of an attack.

+-

Security Council

Yes

HIGH

Definition

Group of people responsible for taking action to increase the DAO's security against harmful proposals through a multisig administered by them.

Risk explained

As of now, Obol Collective functions with a small committee multi-sig (2/3) but intends to develop towards a full Security Council structure. Treasury is not controlled by governance, but malicious proposals may still pose a risk to the protocol and its users.

+-

Spam Resistance

No

HIGH

Definition

Protection against an attacker submitting several proposals at once to trick the organization's members into approving a malicious proposal.

Risk explained

Obol governance is vulnerable to spam.

+-

Voting Delay

1 day

HIGH

Definition

Waiting period between proposal submission and the snapshot to count for voting power and start the votes.

Risk explained

With such a low voting delay, the DAO does not have time to mobilize voters to protect itself from a potential attack.

+-

Vote Mutability

No

MEDIUM

Definition

The governance contract accepts changes to votes even after they have been cast on-chain.

Risk explained

Votes cannot be changed once cast, which can lead to suboptimal governance outcomes if voters make mistakes or if new information arises after voting has begun.

+-

Voting Period

5 days

MEDIUM

Definition

Period in which wallets with governance tokens or delegates have the opportunity to vote on proposals submitted to governance.

Risk explained

Short voting period may compromise quality of governance decisions by limiting time available for community-wide discussion and participation.

+-

Attack Profitability

No Treasury Control

LOW

Definition

Compares the cost of all delegated votes with the value of assets in the DAO treasury excluding its governance tokens.

Risk explained

The DAO has no treasury directly controllable by governance, so there is no risk of attack profitability.

+-

Proposal Flashloan Protection

Yes

LOW

Definition

Protects the DAO from users creating a proposal using voting power from borrowed tokens via flash loan.

Risk explained

Voting power is based on block previous to when voters could first cast a vote, making flashloan votes impossible.

+-

Timelock Admin

Obol Governor

LOW

Definition

Controls whether governor's administration can be transferred or shared with addresses other than the DAO itself.

Risk explained

Obol Governor has admin rights for proposing, executing, and cancelling proposals, which is a standard and secure setup for DAO governance.

+-

Timelock Delay

5 days

LOW

Definition

Waiting period to execute a proposal after it's approved. Aims to prevent the automatic execution of a malicious proposal that negatively affects the DAO.

Risk explained

The timelock delay is longer than 1 day

+-

Veto Strategy

Yes

LOW

Definition

Allows governance members to cancel a proposal submitted to the DAO after it has been submitted/approved.

Risk explained

Governor has veto powers over the timelock, providing an additional layer of security against malicious proposals.

+-

Voting Flashloan Protection

Yes

LOW

Definition

Protects the DAO from users manipulating votes using voting power from borrowed tokens via flash loan.

Risk explained

Voting power is based on the proposal snapshot timepoint, making flashloan votes impossible.

+-

Voting Subsidy

Yes

LOW

Definition

The DAO sponsoring the gas costs of voting for its members allowing them to essentially 'vote for free'.

Risk explained

Obol Collective has a voting subsidy mechanism in place to reimburse voters for gas costs incurred when voting on proposals, but it is not active as of now.