Ten Ways DAOs Get Owned: A Governor Maintainer's Threat Model

Duration: NaN:NaN:NaN

Speaker: Luiz Vasconcelos

Type: Talk

Expertise: Some familiarity with the topic

Event: Devcon

Date: Nov 2026

Onchain governance concentrates the two things attackers love: authority and money. Yet many governance systems are configured at launch and never threat modeled again. Drawing on maintaining the governance contracts behind many of the largest DAOs, and on the public incident record, this talk walks through ten takeover and griefing patterns, including: - Voting power from nowhere: flash loans, and why checkpointing exists - Quorum decay in aging DAOs, where yesterday's safety margin becomes a rubber stamp - Proposal spam and frontrunning as denial of governance - Timelock role hygiene, from open executors to admin capture - Delegation markets and vote buying - Cross-chain execution, where a message bridge quietly joins your trust model Every pattern is paired with a real incident or disclosed vulnerability and a concrete mitigation: parameters, role setup, monitoring, and the escape hatches users should demand. Attendees leave with a checklist to run against any live governor.