Governance

The standard architecture, and what it is allowed to execute

Almost every EVM protocol runs some version of the same two contracts. Token weighted voting decides the outcome, a passed proposal is queued in a timelock, and after a mandatory delay it executes. OpenZeppelin's reference implementation splits what would otherwise be one admin into separate roles: a proposer role that schedules operations, an executor role that runs them once due, and a canceller role that can kill a scheduled operation before it fires.¹

One line in that documentation does more work than the rest. It is the timelock, not the Governor, that has to hold the assets being governed.¹ The Governor counts votes. The timelock owns things. Any contract whose owner is not the timelock is outside the system regardless of what the governance page says.

Compound's live deployment is the reference example of scope. Each protocol contract is controlled by the Timelock contract, which can modify system parameters, logic and contracts in what the docs call a time delayed, opt out upgrade pattern. COMP holders formally control interest rate models, collateral factors, market listings and treasury operations, through Governor Bravo and the Timelock rather than directly.²

Where effective control leaks

There are four common leaks and they are all boring, which is why they survive. A proxy admin or owner address on a live contract that is an externally owned account or a multisig rather than the timelock. A separate emergency multisig holding its own authority over the same contracts. The canceller role, which can stop a scheduled operation after it has passed a vote.¹ And a treasury that was never transferred to the timelock in the first place.

Off-chain voting deserves its own line. A Snapshot vote is a signed message, not a transaction. Something has to carry the result onchain, and that something is usually a multisig. Which makes the execution step discretionary by construction. We are not naming a protocol that formally refused to execute a passed off-chain vote, because we did not find a documented case of one. The point is structural rather than anecdotal: if the execution path runs through people, the vote is advisory whatever the forum post claims.

AIP-1: the gap, on the record

The clearest documented version of this gap is Arbitrum's first governance proposal. On 15 March 2023 the Arbitrum Foundation posted a draft of AIP-1 alongside the DAO Constitution. As the community read it, the proposal gave the Foundation control of 750 million ARB, roughly 7.5 percent of supply and around a billion dollars at the time, for grants, reimbursements and operating costs, without a prior binding DAO vote. Snapshot voting opened on 27 March 2023 and AIP-1 failed on 3 April 2023 with roughly 76.67 percent against.³ A second outlet reported the same figures and the same sequence.⁴

What happened next is the part worth studying. The community then had to put up a separate proposal asking the Foundation to return 700 million ARB to the DAO treasury.⁵ Read that slowly. A vote was required to claw back control of assets the token holders had been told they governed.

The lesson is not that Arbitrum behaved unusually. It is that formal control was tested in public and turned out to be narrower than the documentation implied. The only reason this can be written with dates and numbers attached is that the test happened on an open governance forum. Most protocols have never had theirs tested, which is not the same as passing.

Three questions that map effective control

The audit takes an afternoon and almost nobody runs it. First: for every contract that holds funds or defines behaviour, who is the owner or proxy admin, and is that address the timelock. If it is an externally owned account or a multisig, the token does not control that contract, whatever the governance page says. Second: what can execute with no vote at all, including pause functions, guardian roles and emergency powers, and what is the blast radius of each. Third: what is the actual path from a passed vote to a state change, and how many humans stand on it.

Write the answers into one table, a row per privileged capability and a column per holder. We build that table on every engagement and it is reliably the most uncomfortable document in the pack, because it is usually the first time a team sees its own control map assembled in one place. Nothing in it is new information. It has just never been written down together.

Participation, and the number nobody actually has

Governance design keeps colliding with a claim that has no study behind it: that most DAOs run under ten percent participation. We looked for the source. The strongest thing available is Falk, Pathan, Rigas and Tsoukalas's 2024 study, which measured onchain turnout across 130 Aave proposals and 141 Compound proposals and reported the average share of total token supply cast at 3.2 percent for Aave and 7.7 percent for Compound.⁶ Two protocols, one denominator, one method, published and dated.

Comparable measured data across DAOs does not exist. Turnout gets reported against total supply, circulating supply or delegated supply depending on who is publishing, and governance systems that are not EVM token voting are counted differently again and land in an entirely different range. A design that assumes a general participation rate is assuming something nobody has measured.

That has a direct design consequence. If turnout is unknowable until you have your own, every parameter that depends on turnout has to be adjustable by governance itself and revisited on a schedule. Quorum is first in that queue. Hard coding a threshold against a number you inferred from a blog post is the failure mode, and it is a quiet one, because the parameter looks deliberate for as long as nobody checks it against a vote.

Designing for the gap instead of pretending it is closed

Every early protocol has a gap between formal and effective control, and that is fine. A three week timelock standing between a critical patch and production is how a protocol dies. The problem is not that the gap exists. The problem is an undocumented gap, because holders eventually find it and they find it at the worst moment.

So we do three things. Publish the control map, retained powers included. Attach a written reduction schedule to each retained power, keyed to a condition that retires it rather than to a date nobody will honour. And route every retained power through a delay long enough for a holder to exit, because the delay is the compensation a holder receives for the power the team kept.

Underneath all of it sits the question of what the vote is even for. Governance rights are worth holding in proportion to what they govern, and a vote over a treasury with no revenue feeding it is a vote over a countdown. The token is the mechanism for allocating what the business produces. If the business produces nothing, no governance design repairs that, and the market prices the difference faster than the forum does.