DAO governance is the process by which token holders in a decentralized autonomous organization propose, debate, and vote on changes, with smart contracts carrying out approved decisions automatically. There is no board of directors and no manager signing off at the end. The rules for who can propose what, how many votes are needed, and how long the community gets to weigh in are written into code deployed on a blockchain, and those rules can only be changed by going through the same voting process they define. Billions of dollars in treasury funds already move through these systems, and the infrastructure is still maturing.
How the Rules Are Written Into Code
Before anyone votes on anything, developers write the governance parameters directly into a smart contract. Those parameters cover the essentials: the minimum tokens needed to submit a proposal, the participation threshold that makes a vote valid, and the length of the voting window. Once the contract is deployed, the only way to change those numbers is through the governance process itself.
OpenZeppelin’s Governor contract has become the standard framework. It treats governance as modular pieces developers can assemble: one module counts votes, another sets quorum, another adds a delay before execution. The default quorum in the framework is 4% of total token supply, which reflects how low participation typically runs.1OpenZeppelin. How to Set Up On-Chain Governance
Thresholds differ significantly between protocols. Compound requires at least 400,000 COMP votes in favor for a proposal to pass, regardless of opposing votes.2Compound v2 Docs. Governance Uniswap sets the bar at 40 million UNI in favor with a simple majority over opposing votes.3Uniswap Foundation. Governance These are absolute counts, so the effective threshold shifts as participation fluctuates.
The Lifecycle of a Proposal
A governance proposal starts as a written document explaining what should change, why, and how the technical implementation works. Most protocols require the proposer to hold or have delegated a minimum stake before the system will accept the submission. Compound requires at least 25,000 COMP delegated to the proposer’s address.2Compound v2 Docs. Governance Uniswap sets its floor at 1 million UNI.3Uniswap Foundation. Governance
Discussion varies dramatically by protocol. Uniswap runs a multi-stage process: at least seven days of public comment, then a five-day temperature check requiring 10 million UNI in support before the proposal advances to a formal on-chain vote.3Uniswap Foundation. Governance Compound skips off-chain phases and moves proposals into a two-day review followed by a three-day voting period.2Compound v2 Docs. Governance
If a proposal meets both quorum and the passing threshold, it doesn’t execute right away. A timelock delay sits between approval and implementation. Compound’s timelock is two days, which puts the full path from proposal creation to execution at roughly a week.2Compound v2 Docs. Governance That gap gives token holders who disagree with the outcome a chance to exit before the change takes effect.
How Voting Power Is Counted
The simplest model is one token, one vote. Hold 500 governance tokens and your vote carries 500 times the weight of someone holding one. Most major protocols work this way. The contract reads your token balance at a snapshot block and applies it as your voting power. The problem is equally straightforward: anyone with enough tokens can dominate.
Quadratic voting tries to soften that concentration. Instead of votes scaling linearly, the cost climbs at a squared rate. One token buys one vote, four tokens buy two votes, nine tokens buy three votes. Voting power is the square root of the tokens you allocate. Large holders can still spend more, but each additional unit of influence costs progressively more.
The catch is vulnerability to Sybil attacks. Split 100 tokens across 100 wallets with one token each, and the square root math hands you 100 votes instead of 10. Protocols using quadratic voting need identity verification to prevent this workaround, which sits awkwardly with the pseudonymous nature of blockchain participation.
On-Chain Versus Off-Chain Voting
On-chain governance records each vote as a blockchain transaction. That creates a permanent, publicly auditable record, but it costs gas. As of early 2026, a typical Ethereum transaction costs pennies, with complex operations like token swaps averaging under $0.05.4Etherscan. Ethereum Gas Tracker During the network congestion of 2021 and 2022, those same transactions routinely ran $50 to $200, which made voting on minor proposals economically irrational for small holders.
Off-chain voting avoids transaction costs entirely. The most widely used tool is Snapshot, which captures each participant’s token balance at a specific block, then lets voters sign their choices cryptographically. Signed votes are stored off-chain, so there’s no gas fee, and results can later be brought on-chain in a single transaction to trigger execution. Layer 2 networks such as Arbitrum and Optimism offer a middle path: fully on-chain governance at fractions of a cent per transaction, with the tradeoff that the governance network is separate from the mainnet where a treasury may sit.
Delegation and Liquid Democracy
Most token holders never vote. Delegation lets their tokens still count. When you delegate, you sign a transaction assigning your voting power to another address without transferring the tokens. Your tokens stay in your wallet, and you keep full ownership and the ability to sell or move them. The delegate gains the right to cast votes using your weight alongside their own.
What makes this “liquid” is that delegation is instantly revocable. You can switch delegates or reclaim your voting power by submitting a new transaction to the governance contract.5Arbitrum DAO. Delegates and Delegation: A Conceptual Overview There is no election cycle or fixed term. If your delegate votes in a way you disagree with, you can pull your support before the next proposal. The contract sums a delegate’s own holdings with all delegated tokens pointing to their address at the snapshot block, and the arithmetic is transparent on-chain.
Who Actually Decides
Low turnout is the defining practical challenge, and the numbers are stark. Research covering proposals on Aave, Compound, Lido, and Uniswap between 2020 and 2022 found average participation ranging from 3.2% to 7.7% of total token supply per vote. Lido averaged just 6.5 individual voters per proposal during that period.
Concentration compounds the problem. In the DAOs studied, the top three or four token holders could unilaterally decide nearly every vote if they agreed with one another. Separate analysis of ten major DAOs found that between 1 in 10,000 and 1 in 30,000 token holders possess enough tokens to pass a proposal single-handedly.6Chainalysis. Dissecting the DAO: Web3 Ownership Is Surprisingly Concentrated Delegation was supposed to help, and it does move idle voting power toward active participants, but it can also amplify concentration when many holders delegate to the same handful of well-known figures.
Legal Liability for Token Holders
A DAO that doesn’t register as a legal entity doesn’t get to exist in a legal vacuum. In most jurisdictions, when two or more people associate to carry on a business for profit, the law treats them as a general partnership by default, whether they intended to form one or not. In a general partnership, every partner is personally liable for the entity’s debts and legal obligations. For token holders, that means potential exposure that reaches into personal assets.
Courts have started testing the theory. In Sarcuni v. bZx DAO, a federal court found that the plaintiffs’ argument that the DAO constituted a general partnership was plausible enough to survive a motion to dismiss, letting the case proceed on whether token holders bore joint and several liability. The CFTC separately obtained a default judgment against Ooki DAO for operating an unregistered trading platform, successfully arguing that the DAO is a “person” under the Commodity Exchange Act. The penalty included a $643,542 fine and a permanent trading ban.7CFTC. Statement of CFTC Division of Enforcement Director Ian McGinley
A handful of states have responded by creating legal frameworks that let DAOs register as limited liability companies, shielding individual members the way a traditional LLC does. These laws generally require the filing documents to specify whether the organization is managed by its members or by its smart contract code. Filing fees run a few hundred dollars, which is trivial compared to the exposure of operating without any legal wrapper.
Securities Classification and Tax Reporting
Whether a governance token qualifies as a security depends on how it is sold and what buyers reasonably expect. The SEC’s analytical framework still centers on the Howey test: an investment of money in a common enterprise with an expectation of profits from the efforts of others points toward a security. In March 2026, the SEC issued an interpretive release establishing a five-part token taxonomy distinguishing digital commodities, collectibles, tools, stablecoins, and digital securities. Under that framework, tokens conveying governance or technical rights within a functional system, without generating passive yield or rights to business profits, are more likely classified as digital commodities. Airdrops, staking rewards, and mining are generally considered outside securities law under the guidance.
A token can start as part of an investment contract and later separate from it once the issuer delivers on its promises or enough time passes, but issuers remain liable for misstatements or omissions made during the original sale. If you launch a DAO and distribute governance tokens, the initial distribution method matters as much as the token’s eventual function.
On the tax side, the IRS treats digital assets, including governance tokens, as property. Every transaction must be reported, whether it results in a gain, a loss, or neither. Tokens received as compensation for contributing to a DAO count as ordinary income at fair market value on the date received, reported on Schedule C for independent contributors or Schedule 1 for staking and similar rewards. Later sales or dispositions go on Form 8949 as capital transactions. Starting in 2026, brokers are required to report cost basis on digital asset transactions, so the IRS will have independent records to compare against individual returns.8Internal Revenue Service. Digital Assets A DAO treated as a partnership for tax purposes would need to file Form 1065 annually, with income, losses, and deductions passing through to members’ individual returns.9Internal Revenue Service. About Form 1065, U.S. Return of Partnership Income Most DAOs are not currently filing partnership returns, but the trend toward treating unregistered DAOs as general partnerships could make that harder to ignore.
Smart Contract Security
Because smart contracts on Ethereum cannot be patched after deployment, any vulnerability in the governance code stays there permanently unless the community migrates to an entirely new contract, and the migration itself has to run through the very system that may be compromised. Smart contract exploits drained over $3.24 billion between April 2018 and April 2022 across the broader ecosystem. Professional audits for governance-level contracts typically cost $15,000 to $50,000 and take one to three weeks. Skipping that step has historically been far more expensive than paying for it.
In 2016, an attacker exploited a reentrancy bug in The DAO’s smart contract and drained roughly 3.6 million ETH, worth about $60 million at the time. The exploit worked because the contract let the attacker withdraw funds repeatedly before the balance updated.
Timelocks serve as a partial safety net after deployment. By inserting a mandatory delay between approval and execution, the community gets a window to detect and respond to malicious proposals that somehow passed a vote. If an attacker accumulates enough tokens to push through a proposal that would drain the treasury, the timelock gives other participants time to withdraw or organize a counter-response before the code runs.10OpenZeppelin. Governance The delay does not prevent an attack, but it limits the damage.