TLDR:
A list of vulnerabilities in DAOs, presented as both opportunities and challenges.
Core Research Question
What does it mean for a “Decentralised Autonomous Organisation” (DAO) to be resilient? In the course of my research on resilience in decentralised technologies, I have defined resilience as adaptability and transformability of participants within a DAO, towards a stated objective. I have also presented a framework for analysing resilience in decentralised systems, predicated on the observation of threats and vulnerabilities, as a way to assess responses and thus resilience in response to these factors.
Citation
Nabben, Kelsie. “DAO Vulnerabilities: A multi-scale DAO ecosystem mapping tool towards computer-aided governance”. Substack. Available online: DAO Vulnerabilities: A multi-scale DAO ecosystem mapping tool towards computer-aided governance.
A link to the original research source: DAO Vulnerabilities: A multi-scale DAO ecosystem mapping tool towards computer-aided governance.
Summary
Throughout my research engagement with DAOs, there are a number of vulnerabilities which are commonplace across multiple DAOs. Vulnerabilities can emerge or be revealed in response to threats. They can be both social and technical. Vulnerabilities can emerge from outside (exogenous) or within (endogenous) a DAO. They can also manifest at or across multiple scales, including the individual (micro), group level dynamics (macro), or broader ecosystem (DAO) level.
Vulnerabilities can also produce opportunities that lead to adaptation, resilience, and growth. These are of course not binary, or right and wrong, but on a spectrum which requires trade-offs.
The purpose of this vulnerability mapping is exercise is to help to characterise common patterns emerging across DAOs, as a means to better understanding resilience in decentralised technologies and the social outcomes of these systems. It is an initial list, and constructive engagement is welcome.
Some of the vulnerabilities in DAOs that I have observed can be categorised according to this ‘model of resilience assessment in DAOs’ as follows. I have not delineated between “threat/vulnerabilities” and “opportunities” in labelling these observations, as it is context dependent, and oftentimes, depends on how a community responds both technically and socially to adapt in response.
Exogenous, social:
-
regulatory burdens: interfacing with meat space legal and tax obligations. A trend is that individual DAO members are responsible for local compliance regarding their token asset ownership and participation, with contract “pop-ups” about as basic as privacy warning, to sign and go with very little understanding of one’s obligations.
Exogenous, technical:
-
Cybersecurity: defending digital infrastructure against technical or social attacks and exploits, such as hacks, multisig wallet funds management, or sybil attacks.
-
Hackers, e.g. “The DAO”, or Poly Network, where the hacker returned the funds.
-
Sybil attacks](Resilience of the Commons: observing “resilience” in the governance of decentralised technology communities), bots (in response to internal, identity management settings).
Endogenous, technical:
- Code bugs, e.g. “The DAO” hack.
Endogenous, social, multi-scale:
- Participation: volunteerism, labour, and capital. Balancing contributions of capital and labour.
This includes the ability to quantify labour, especially in participatory processes where synthesis of information, communication, and coordination are critical functions, but difficult to measure.
-
Legitimacy: Having legitimate leaders to lead the people delivering the protocol. “The key is that humans must deliver the code and other outcomes, but those same people cannot control the protocol” (Kain, Synthetix). In some cases, benevolent dictators are helpful and necessary for pursuing long-term strategic goals.
-
Capital: Determining the appropriate capital model, between external investment and issuing tokens.
-
Token issuance (see “DAOFirst” and ‘exit to DAO”).
-
Treasury management: managing liquidity and determining when and how much to spend, or not.
-
Culture: the necessity of a “cultural build”.
-
Collusion: inequalities, incentive misalignments, or outright attacks in coin voting governance that can lead to vote buying.
-
Politics: all infrastructure is political.
-
Scale: maintaining clear information and communications as the project scales in both capital and community. Scaling trust beyond known peers.
-
Strategy: setting long and short-term objectives, pursuing them, and measuring “success”. Short-termism can be a “governance extractible value”, versus a long-term perspective.
-
Algorithmic automation
-
Human oversight over algorithms
-
Governance design: over-emphasis on voting as governance, rather than recognising the culture, communication, informational management, education, and political processes that inform a final vote on each proposal, and technical mechanisms as components of a healthy governance process.
-
Voice and mob-mentality: in numerous DAOs, participants are afraid to express their opinion in the fear that the masses with physically come after them, or they will expend valuable political capital in doing so.
-
Decentralisation, or even transparency, of certain critical functions. This includes those that must be subject to privacy clauses due to data sensitivities or risk to the project (such as anti-sybil detection flagging).
-
Political solutionism. Same as tech solutionism but with politics to “civilise” the complexity of society (see Willke, 1989).
-
Bureaucracy:](A DAO is a bureaucrat. People think of DAOs as code… | by Ellie Rennie | Medium) ever increasing rules, policies, and processes, including taxes, and more.
-
Responsibility, accountability, and recourse: when a DAO exits, responsibility can be scapegoated to “the community” without the clear, necessary institutional rules, systems, and processes in place for long-term, sustainable infrastructure. “The DAO Model Law” argue that DAOs require internal and external arbitration mechanisms.
A DAO Questionnaire
These are just some threats, vulnerabilities, and opportunities emerging in decentralised autonomous organisations. From this list, it is evident that “DAOing” governance can both create or reduce vulnerabilities in decentralised infrastructure communities. What is interesting is how many threats and vulnerabilities emerge from within the DAO, rather than from the outside.
Although unknown vulnerabilities remain, the practice of reflexivity is one way to help surface and acknowledge them.
The next section focuses on how you get from categorisation and prioritization of governance vulnerabilities to fixing and improving. In terms of enacting this framework, some questions for DAOs that emerge from this framework, include:
-
What is the objective of the DAO community? (goal of systems and goal of individuals within it)
-
What are its defining cultural factors? Have you initiated a cultural build, and what does this look like?
-
Is the strategy short term or long-term? (seasonal, or for a long-standing purpose).
-
Are you focused on product innovation or organisational innovation? (doing both simultaneously is hard, as governance researcher at Blockscience Burrrata points out).
-
What is the intended size and scale of the DAO?
-
How does trust and reputation work in the DAO? How do you want it to work (trust minimization towards “trustless”, or trustful infrastructure?)
-
How does labour and accountability work in the DAO? How do you want it to? (core work, care work. Responsibility, accountability, and recourse. Tacit or implicit incentive structures and rewards, etc.).
-
Do your governance structures and ways people can participate leave you vulnerable to collusion attacks?
-
Do your governance structures and mechanisms and ways people can participate leave you vulnerable to bribery attacks?
Just DAO it?
The statement “whoever controls infrastructure, controls society” encapsulates the vision of decentralised technologies communities, who seek emancipation from the external forces of power and influence for their own self-determination. DAOs are one manifestation of this. Digital infrastructure is a powerful tool. They are an attempt at “shaping the field of play” by defining incentives and constraints for self-governance (or autonomy) outside of existing institutional infrastructures. This does not mean that they are free of politics, self-interest, exploitation, and other forms of vulnerability or attack.
The critical question for DAOs is how can they legitimately design adaptive capacity into these systems, both human and algorithmic, whilst maintaining their call to decentralisation, to withstand the inevitable growing pains of evolving into functional infrastructure? This post has been a mapping exercise. Michael Zargham, Founder and CEO of Blockscience argues that “It is important to make the governance surface explicit, and where possible it is important the effects of tuning such a parameter are relatively straightforward.” The next step after mapping the threats, vulnerabilities, and opportunities, is to govern vulnerabilities through social and technical interventions. This is the active space of crypto DAO-dom, as communities engage in social and technical creation, iteration, maintenance, and collapse of these institutional infrastructures. Part of the challenge of this exercise is to actually do something different in-line with the central ideas of “political decentralisation” and “autonomy”, rather than recreate the hierarchies, inequalities, and exploitation that these communities criticise in physical infrastructure and Web2.0 digital infrastructure.
Are DAOs resilient?
For more on this topic, I have presented a history of the concept of DAOs, how DAOs emerge as DAOFirst or “exit to DAO” in the first step of the “lifecycle” of a DAO, and the importance of culture. In a forthcoming paper, I argue that the idea of “autonomy” in DAOs is an imaginary, which both helps bind a community in participating towards the objective of effective self-governance and creates risks of abuse of power and exploitation. I have argued that DAOs are not just seeking to self-govern against external forces, but to balance individual and collective autonomy, and that there are inherent trade-offs between individual autonomy and participation in a community. I have then cautioned that the greatest threat to a DAO is not an external threat of outside influence but that the greatest threat to a DAO is itself. In these infrastructural assemblages of code and people, the ability to consciously reflect on, shape, and iterate on the algorithmic governance rules of these experimental institutions in the practice of algorithmic policy making affords the people within them with adaptive capacity to participate in shaping the rules of the system. I have questioned the ability to scale this essential participation in these institutional infrastructures beyond the need for trust between people in a way that represents the preferences of people. In this way, a DAOs greatest vulnerability, in having participatory rule-making, is its greatest strength if sustained.
Acknowledgments:
Thank you to Blockscience, especially Burrrata and Michael Zargham, and David Sisson for reviewing and for numerous “Computer Aided Governance” calls that contributed to the formation of these ideas.
An image of the “DAO vulnerabilities” model can be found at the original source.