DAO Governance Security Checklist

By the Guardian team Updated November 2026 6 min read

Quick answer. Count votes from a snapshot taken before voting opens, set thresholds that resist capture, and simulate every proposal. Execute through a timelock holding the treasury, with a narrow guardian, isolated signer and delegate keys, and proposal monitoring.

Watch: DAO Governance Security Checklist 1:43

Video transcript

A DAO's governor is often its most powerful admin key. Whoever passes a proposal can move the treasury or upgrade the protocol.

In 2024, a 24 million dollar Compound proposal passed over delegates' objections, with only 57 addresses voting.

Count votes from a snapshot before voting opens, so borrowed tokens carry no votes. Tie quorum to delegated supply, leave time after quorum, and flag large new delegations.

For every proposal, someone other than the author decodes the calldata, it is simulated on a fork, contracts are verified onchain, and a named reviewer gets alerts.

A timelock is the exit window. It should hold the treasury, ownership and admin roles, not the governor. Compound's delay runs two days after queuing.

Drift's council ran two of five with no timelock, so two signers who pre-signed transactions handed an attacker admin control. Arbitrum's needs nine of twelve, then publishes a report.

A large delegate is a signer in all but name. The draft DAO Security Standard marks isolated hardware wallets mandatory. Verify payloads on your own device and never pre-sign.

Finally, the governor itself. In 2022, an attacker reinitialized Audius's governance contracts, delegated itself 10 trillion votes, and moved over 18 million AUDIO from the treasury.

Guardian's Managed Security maps every path to your funds and monitors privileged calls on every block. Read the full checklist, or talk to Guardian.

A DAO's governor is often its most powerful admin key. Whoever passes a proposal can move the treasury or upgrade the protocol.

In 2024, a $24 million Compound proposal passed over delegates' objections. In 2026, Drift's Security Council could act with two signatures and no delay.

This checklist covers the controls. For how the attacks themselves work, including Beanstalk's flash loan, read DAO governance attacks.

Voting Power and Quorum

Start with what counts as a vote. OpenZeppelin's Governor reads voting power "from past snapshots rather than current balance".

Its voting delay sets how long after a proposal is created voting power is fixed. Compound likewise counts the votes delegated to an account when the proposal became active.

That is the core flash-loan defense. Tokens borrowed after the snapshot carry no votes.

Quorum is the next line, and a few large holders can still meet it. Compound's Proposal 289 shows how, per The Block and Rekt:

It allocated 499,000 COMP, about $24 million, to a product its proposers created.
Wintermute warned that withdrawals were "solely controlled" by the proposers' multisig.
It passed 682,191 to 633,636 on July 28, 2024. Only 57 addresses voted.
It was canceled the next day in a negotiated truce.

The controls:

Voting power comes from a snapshot taken before voting opens.
No path, emergency paths included, counts current balances.
Quorum tracks delegated supply and has a floor.
Quorum cannot be reached in the final block without time to respond.
Large new delegations before a vote raise an alert.

Arbitrum's constitution sets quorum as a share of delegated votable tokens, with a floor and a cap. OpenZeppelin's GovernorPreventLateQuorum guarantees a minimum voting period after quorum is reached, "as a security protection against large voters".

Proposal Review and Monitoring

Next, what gets proposed. A proposal threshold limits who can submit: Arbitrum requires an address delegated at least 1,000,000 votable tokens.

The DAO Security Standard is a draft, not a binding rule. Led by DAOstar, eth.limo and Tally, its version 1.0 was posted to Arbitrum's forum for feedback on November 1, 2024.

The draft recommends simulating proposals before executing them and running automated checks on proposals for common attacks.

Someone other than the author decodes the calldata and matches it to the description.
Every proposal is simulated on a fork of current state before voting ends.
Every attached or upgraded contract is reviewed and verified onchain.
Treasury transfers name the recipient, who controls it and who can withdraw.
New proposals, large votes and queued operations alert a named reviewer.

Timelocks and Veto

A timelock is the exit window. OpenZeppelin says it "allows users to exit the system if they disagree with a decision before it is executed".

It also says the timelock, not the governor, "should hold any funds, ownership, and access control roles".

The timelock holds the treasury, contract ownership and proxy admin rights.
The governor is the only proposer. OpenZeppelin calls extra proposers or cancellers "risky".
The timelock's admin role is renounced after setup.
The delay gives holders time to exit. Compound's runs two days after queuing.
Changes to the delay or the governor wait out the full delay.

Some DAOs add a veto from outside the token vote. Lido's Dual Governance design lets stETH holders lock tokens to delay DAO decisions, and exit through a rage quit.

Arbitrum stacks delays instead. A constitutional proposal typically takes at least 42 days from temperature check to execution.

Emergency Roles

Emergency powers are real powers. Write down exactly what each one can do.

OpenZeppelin's GovernorProposalGuardian adds a guardian that "can cancel proposals at any stage". A guardian that can only cancel cannot steal.

Arbitrum's Security Council has 12 members. Any emergency action needs 9 of 12, followed by a public transparency report.

On October 30, 2026, it used those powers to force two transfers out of the Binance attacker's wallet on Arbitrum, about $30 million, per TRM Labs.

The failure mode is a council that is easy to capture. Drift's ran 2-of-5 with zero timelock, per BlockSec.

Two signers were induced to pre-sign transactions that handed an attacker admin control. About $285 million followed.

Each emergency role lists its powers: cancel, pause, upgrade or move funds.
Cancel and pause roles are separate from any role that moves funds.
Thresholds are high and signers independent of each other.
Every emergency action is published with its reason.
Non-emergency admin actions always wait out a delay.

Drift's full sequence is in our Drift exploit breakdown.

Delegate and Signer Keys

A large delegate is a signer in all but name. A stolen delegate key votes like the real one.

The draft DAO Security Standard marks this mandatory: "Use isolated and purpose specific hardware wallets for multisig key holders and delegates."

It also asks DAOs to publish a physical security policy and train against wrench attacks.

Delegates and signers use dedicated hardware wallets for governance only.
Signers decode and verify every payload on their own device.
No one pre-signs governance transactions for later execution.
Changes to signer sets, thresholds and large delegations alert the DAO.

For the full signer policy, see multisig best practices.

Upgrade Paths

Finally, the governor itself. A governance contract that can be upgraded or reinitialized can be taken over.

In July 2022, a storage collision with OpenZeppelin's Initializable let an attacker reinitialize Audius's governance contracts, per Rekt.

Control of those contracts let it change the guardian address and delegate itself 10 trillion AUDIO in votes. It then passed a proposal moving 18,564,497 AUDIO out of the treasury.

Proxy admin rights sit with the timelock, never a single key.
Every initializer runs at deployment and cannot run again.
Storage layouts are checked on every upgrade of a governance contract.
Upgrades wait out the timelock, as the draft standard recommends.
Upgrade code is audited, which the draft standard marks mandatory.

For the pipeline around each upgrade, see smart contract change management.

How Guardian Helps

Guardian's Managed Security maps every path to a protocol's funds: the contracts that hold them, the roles that can move them, and the keys behind each one.

It monitors contracts on every block for privileged calls, role and ownership changes, upgrades and multisig transactions. Its security operations team reviews every multisig transaction before it is signed.

Alerts go to a 24/7 MDR team with a 15-minute SLA on Critical alerts. Before launch, a smart contract audit reviews governance, roles and upgrade paths.

Frequently Asked Questions

What security controls should a DAO's governance system have?

Count votes from a snapshot taken before voting opens, set quorum and proposal thresholds that resist capture, and simulate proposals. Execute through a timelock that holds the treasury, with a narrow guardian, isolated delegate and signer keys, and live monitoring.

How do DAOs stop flash-loan governance attacks?

By counting voting power at a snapshot taken before voting opens, as OpenZeppelin's Governor and Compound do. Tokens borrowed and repaid in one transaction hold no votes at that snapshot. Emergency paths must use it too.

What is a DAO timelock?

A contract that delays the execution of passed proposals, so holders can exit or object first. It should hold the treasury, ownership and admin roles. At Compound, a passed proposal can execute two days after it is queued.

What should a DAO security council be allowed to do?

Only what an emergency needs, written down, such as cancel, pause or an emergency upgrade. Use a high threshold, like Arbitrum's 9 of 12, and publish a report after every action. Drift's 2-of-5 council with no timelock shows the risk.

Sources

Map your governance powers with Guardian

Guardian maps every role that can move your treasury and reviews every multisig transaction before it is signed.

Talk to Guardian Explore Managed Security