DAO Treasury Management: How to Secure a Community Treasury

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Split the treasury by function: reserves behind governance or a high-threshold Safe, operating funds in a smaller Safe with spending limits. Scope delegated managers with onchain roles, spread stablecoin exposure, and monitor every signer, module and outflow.

Watch: DAO Treasury Management: How to Secure a Community Treasury 1:38

Video transcript

A DAO treasury is often the largest pool of value a protocol controls. Anyone who can move it is part of its attack surface.

Three layers can move the funds: governance votes through a timelock, the treasury multisig, and modules and roles given to managers and bots. Map all three first.

Drift's Security Council ran two of five with zero timelock, per BlockSec, which estimated the loss at about 285.3 million dollars.

So split the treasury by function. Reserves sit behind governance or a high-threshold Safe. Operating funds sit in a smaller Safe sized to one budget period, so a breach costs one period, not the reserve.

Modules let a Safe delegate narrow powers. Spending limits cap amounts per token, but not where funds go. Zodiac Roles can scope addresses, functions and parameters. Review every module before you enable it.

Delegations must end. Axie DAO's whitelist access for Sky Mavis was never revoked, Rekt reported, and it gave the Ronin attacker its fifth signature. The loss was about 624 million dollars.

Then watch everything. Alert on owner, threshold and module changes, on module executions, on proposals that touch the treasury, and on large outflows or any cold wallet movement.

Guardian's Managed Security maps every path to your funds and reviews each multisig transaction before it is signed. Read the full guide, or talk to Guardian.

A DAO treasury is often the largest pool of value a protocol controls. Anyone who can move it, by vote, signature or delegated role, is part of its attack surface.

Our DAO governance security checklist covers votes, proposals and timelocks. This guide covers the money itself: where it sits, who can spend it, and how you see it move.

How DAO Treasuries Are Held

Three layers can move a DAO’s funds. Map all three before you change any of them.

Layer	Who acts	Main risk
Governor and timelock	Token holders, by vote	A captured vote or a disguised proposal
Treasury multisig	A council or signer set	Tricked or compromised signers
Modules and roles	Managers, contributors and bots	Scope too wide, or never revoked

Safes, Signers and Timelocks

The Security Alliance (SEAL) gives the treasury its own Safe: a high threshold, with 4 of 7 as its example, and signers separate from protocol admin.

For treasuries it adds two rules:

Longer timelocks on wallets that are seldom used.
Alerts to the whole team on any activity in those wallets.

A low bar is expensive. Drift’s Security Council ran 2-of-5 with zero timelock, per BlockSec.

Two signers were induced to pre-sign malicious transactions. BlockSec estimated the April 1, 2026 loss at about $285.3 million.

Signer keys, outside signers and offboarding are covered in multisig best practices.

Reserves vs Operating Funds

SEAL’s treasury requirements read like cash management:

Cold wallets hold the majority of assets.
A hot wallet is the intermediary, with at least a 2-of-3 quorum.
Cold wallets send only basic transfers, to the hot wallet.
At least three equally funded cold wallets, each under a different multisig.

For a DAO, that maps to two tiers. Reserves sit behind governance or a high-threshold Safe. Operating funds sit in a smaller contributor Safe, topped up on a schedule.

Size the operating Safe to one budget period. A compromise then costs that period’s spending, not the reserve.

Stablecoin exposure

Runway held in the DAO’s own token falls when the token does. Stablecoins carry a different risk: the issuer’s reserves and banks.

In March 2023, Circle said $3.3 billion of USDC’s roughly $40 billion in reserves remained at Silicon Valley Bank. USDC fell to 95 cents against USDT on Kraken, CoinDesk reported.

Write target ranges for the native token, stablecoins and other assets.
Spread stablecoin holdings across more than one issuer.
Name who may rebalance, on which venues, and within what slippage.

For one issuer’s reserves and contract controls, see Is USDC safe to hold?

Spending Limits and Roles

A full vote or a 4-of-7 signature for every payment does not scale. Modules let a Safe delegate narrow powers instead.

SEAL lists an allowance module as required for all treasury multisigs.

Spending limits

Safe’s spending limits let a chosen address withdraw a capped amount of one token without other signatures. The spender can be a bot, a teammate or an external wallet.

A limit can be one-time or reset after a set period. Transfers above it need the normal threshold.

The catch: Safe notes that limits cap amounts per token and do not restrict where the spender sends. Pair them with small balances and outflow alerts.

Zodiac Roles

Gnosis Guild’s Zodiac Roles Modifier is an onchain permissions module for smart accounts such as a Safe.

A role can be scoped to authorized addresses, designated functions and allowed parameter values, with limits on how often it is used.

Safe’s docs say modules “can execute arbitrary transactions” and warn that “a malicious module can take over a Safe.” Review each one before it is enabled.

Delegated managers

ENS DAO’s endowment shows the pattern. In January 2023, it was set up with karpatkey as manager, working through a Safe and the Roles Modifier.

The initiation post says the Roles Modifier “limits kpk’s actions by only allowing the execution of predetermined transactions.” New permissions need a forum post and a DAO vote.

The risk is a delegation that outlives its purpose.

In November 2021, Axie DAO let Sky Mavis sign on its behalf. The arrangement ended the next month, but Rekt reported “the whitelist access was never revoked.”

In March 2022, that access gave the Ronin attacker its fifth validator signature, enough for the bridge’s five of nine. Rekt put the loss at about $624 million.

Scope every role to named contracts, functions and parameters.
Pin recipients to DAO-owned addresses.
Give each role an end date or a review date.
Keep module ownership with the DAO’s Safe, as ENS did.
Test revocation before you need it.

Monitoring and Reporting

A malicious proposal is public before it executes. Someone has to be watching.

In July 2022, an attacker reached quorum on a Yam Finance proposal that would have made it admin of the treasury’s funds.

The team canceled it before execution, using its own privileges, Decrypt reported.

SEAL asks for a third party to watch timelocked transactions. It must simulate every pending transaction and report at least 48 business hours before the timelock lapses.

Alert on:

Owner, threshold, module and guard changes on every treasury Safe.
Every module execution and every spending limit change.
New proposals that touch treasury addresses or roles.
Outflows above a set size, and any movement from cold wallets.

Event names and first responses are in Safe multisig monitoring.

Then publish what you watch: treasury addresses, signers, thresholds, modules and roles, with a regular holdings report. Delegates can only check what they can see.

DAO Treasury Checklist

Treasury Safes separate from protocol admin, with their own signers.
A high threshold, such as SEAL’s 4 of 7, and one outside signer.
Reserves in cold wallets; operating funds topped up on a schedule.
Written target ranges for native token and stablecoins.
Spending limits and roles scoped to contracts, functions and recipients.
Modules owned by the DAO, with end dates and tested revocation.
Offboarding deadlines for signers and managers.
Alerts on configuration changes, module use and large outflows.
A public register of addresses, signers and roles.

How Guardian Helps

Guardian’s Managed Security maps every path to your funds: the contracts that hold them, the roles that can move them, and the keys, signers and multisigs behind each one.

Its security operations team reviews every multisig transaction before it is signed. Contracts are monitored on every block for privileged calls, role and ownership changes, multisig transactions and large fund movements.

For onchain teams, multisig management reviews the signer set and threshold as people join and leave, simulates transactions before approval and tests recovery.

An OpSec audit maps who can move funds, whether that sits behind a threshold or a single key, and how fast it can be used.

Frequently Asked Questions

What is DAO treasury management?

The controls for holding, spending and investing a DAO’s assets. They set where funds sit, who can move them, how spending is limited, and how outflows are watched and reported.

Should a DAO treasury use a multisig or governance?

Often both. Reserves sit behind governance or a high-threshold Safe; operating funds sit in a smaller Safe. SEAL’s treasury example is 4 of 7, with signers separate from protocol admin.

What is the Zodiac Roles Modifier?

An onchain permissions module for smart accounts such as a Safe, built by Gnosis Guild. It grants an address rights over named addresses, functions and parameter values, with usage limits. ENS DAO adopted it to limit its endowment manager.

How do Safe spending limits work?

The allowance module lets a chosen address spend a capped amount of one token without other signatures, once or per period. Limits do not restrict recipients, so keep balances small and alert on outflows.

Sources

Map every path to your treasury

Guardian maps the signers, modules and roles that can move a DAO’s funds, and reviews every multisig transaction before it is signed.

Talk to Guardian Explore security for onchain teams