How a vote becomes a transfer
A decentralized autonomous organization, or DAO, often keeps shared funds in a smart contract: software on a blockchain that can hold assets and perform specified actions. Its governance rules may let token holders propose changes and vote on them. A proposal can include an instruction to move money, not merely a recommendation to do so.
If the proposal meets the DAO’s voting requirements, the contract—or a designated executor—can carry it out. Depending on the rules, approval may require a majority of votes cast, a minimum turnout, or both. Token weight, rather than the number of individual people, commonly determines voting power, so a small group with many tokens can outweigh a larger group with fewer.
The weak point is control of the vote
An attacker does not necessarily need to break the contract’s code. If they can gain enough voting power under the DAO’s rules, they may be able to make a malicious transfer look like a valid decision. That power might come from tokens they already control or can otherwise obtain; what counts depends on how the DAO measures voting power and when it measures it.
Once the vote passes, the danger is that execution may be automatic or available to anyone. A transfer to an attacker’s wallet can therefore be difficult or impossible to reverse: blockchain transactions generally do not include a built-in way to cancel a completed payment.
Rules can slow or block a takeover
DAOs can limit the risk with measures such as waiting periods before execution, minimum participation requirements, caps on what a proposal can transfer, or separate review and emergency controls. These safeguards involve tradeoffs: extra checks may give members time to notice a harmful proposal, but can also delay legitimate spending or require trust in a smaller group.
The key question is not simply whether a DAO has a vote. It is what the vote is allowed to execute, who can control it, and whether anyone can intervene before the transfer becomes final.
