Issue 8: Why Token Votes Don't Control What They Claim

In 1911 Robert Michels went looking for democracy inside the organisations most committed to it, the European socialist parties and trade unions, and could not find any. Power concentrated anyway. Not through conspiracy, but because running an organisation requires specialists, specialists accumulate the knowledge and the relationships, and everyone else has better things to do. He called it the iron law of oligarchy: who says organisation, says oligarchy.

The obvious objection is that Michels was describing a technology problem. Meetings are slow, ballots expensive, information asymmetric, so of course a committee ends up running things. Fix the plumbing and you fix the politics. That objection is roughly the founding premise of the token DAO: put membership on-chain, make voting nearly free, publish the ledger, and the oligarchy has nowhere to hide.

Twelve thousand of those experiments have now been run. In May 2026 Circle's research team published a result that reads like Michels with the arithmetic filled in: the voting systems designed specifically to prevent plutocracy do not prevent it. Concave schemes, quadratic voting among them, collapse back to one-token-one-vote once an attacker splits a holding across enough wallets. Not hard to implement. Reducible, by construction.

I had assumed quadratic voting was the answer here and the rest was engineering. It fails as a property of the mechanism rather than of any deployment, which is a better result than I expected: it converts a decade of governance design from a search for the right voting curve into a search for something that is not a voting curve at all.

Which brings us to the same month, when an Arbitrum security council froze roughly $72M with a nine-of-twelve multisig, moved it, and the DAO voted afterwards on whether that had been acceptable.

Four failure modes, unequal evidence for each, and a Checker that scores a governance rule against all four before you ship it.

Ten from the wave.

1. Circle Research, 2026-05-20. "Concave is the New Linear: The Impossibility of Anti-Plutocratic DAO Governance." Concave voting functions, quadratic included, reduce to one-token-one-vote by splitting tokens across wallets. The anti-plutocracy guarantee does not hold in a permissionless setting. circle.com
2. Arbitrum security council, reported 2026-05-02 by @aixbt_agent. A nine-of-twelve multisig froze about $72M and redirected it to Aave, Lido, EtherFi and Compound rather than to the 112 liquidated users; the DAO then moved to ratify retroactively. Our record is one social-media report, so the sequence is better attested than the figures in it.
3. Kitzler et al., The Governance of Decentralized Autonomous Organizations, Financial Cryptography 2024 (arXiv:2309.14232). Contributors held the majority needed to control outcomes in 7.54% of DAOs and singularly decided a proposal in 20.41%. And the finding that should worry you most: ownership shifted shortly before the poll in 1,202 of 8,116 proposals, 14.81%. One vote in seven was preceded by somebody acquiring the power to decide it.
4. @Web3Vacancy, 2026-05-13, citing DeepDAO and Snapshot: median turnout near 8%, insiders holding over half the supply in 42% of DAOs. Posted analysis, not peer reviewed.
5. @token_analysis, 2026-06-26. In 73% of DAO votes that met quorum, the outcome matched the top three holders. Quorum was reached; it did not change who decided. Posted analysis with no methodology or sample size, so directional rather than measured.
6. Beanstalk, 2022-04-17. A malicious proposal pushed through with a flash loan, the attacker voting to send the treasury to themselves. $181M in one block (rekt; DefiLlama's technique field reads Flashloan Governance Attack).
7. BonkDAO, 2026-07-06. The version needing no flash loan: the attacker bought enough token to pass a proposal draining the treasury, about $4M to take roughly $20M (CoinDesk). Three weeks ago.
8. Gnosis GIP-150, reported 2026-05-05 by @DefiIgnas. Holders moved to force treasury redemption because the treasury was worth more than the token, against roughly $30M a year of spending on about $400k of revenue. Governance worked as designed and the design pointed at dissolution.
9. MetaDAO, reported 2025-10-13 by @lex_node, rejected two VC proposals to buy discounted tokens. The only documented case here of a token vote refusing money.
10. Vitalik Buterin, 2026-01-19: "We need more DAOs - but different and better DAOs." Reported by Decrypt. His position for years has been that coin voting is the part to replace, not to optimise.

This week's tool is the DAO Governance Failure Checker: it reads a governance rule, or a proposal in prose, and scores it against all four modes. It follows The Read.

The Read: four ways a vote fails to be a decision

The four modes are four places where the chain from "holders preferred X" to "X happened" can be cut. What follows says how strong the evidence is for each, because it is not equally strong, and pretending otherwise would be its own kind of governance theatre.

1. Post-vote execution collapse. The proposal passes. Nothing executes. No re-vote, no veto, no announcement, just a proposal that stays approved and never ships.

This mode has the most practitioner testimony and the least measurement. The corpus carries several independent accounts and not one names a proposal that passed and demonstrably died. The mechanism argument is clean: voting produces a political record, execution produces operational liability, and nobody is paid to convert the first into the second. But an argument is not a measurement. If you have a proposal ID where this happened, I would like it.

2. Apathy enabling capture. Turnout is thin, so a small bloc is the effective quorum.

This one is measured, and it matters which part is measured by whom. Kitzler and co-authors, peer reviewed across 872 DAOs: contributors held the controlling majority in 7.54% and singly decided a proposal in 20.41%. Posted analysis puts median turnout near 8% and the top three holders getting their way in 73% of quorate votes. The directions converge, but the peer-reviewed half is the half I would defend.

Capture does not require anyone to behave badly. At 8% turnout a small holding is decisive, so the rational move for a fund is to specialise in governance while everyone else specialises in yield. The apathetic majority is not negligent. It has correctly priced its own influence at approximately zero.

3. Token-vote irrelevance. The vote is recorded and the outcome is set somewhere else.

This is the strongest of the four and the one the taxonomy under-weights. It has a formal result, a measurement and a dated case, not equally solid. The formal result is Circle's and it is load-bearing: if a curve designed to blunt concentration reduces to one-token-one-vote by splitting a wallet, the curve was never what constrained the outcome. The measurement is the 73%, directional. The case is Arbitrum: freeze, redirect, then vote.

This mode is not corruption and not incompetence. In all three the process ran correctly. The vote is not overridden, it is routed around, which is much harder to fix because there is no violation anywhere in the log.

4. Incentive misalignment. Voting power is rentable, so the payoff is the bribe rather than the outcome.

Beanstalk makes this concrete. In April 2022 an attacker took a flash loan, used the borrowed weight to pass a proposal sending the treasury to themselves, and repaid the loan in the same block: $181M, no exploit, no bug, the voting system working exactly as specified. Nothing in a token-weighted system distinguishes a holder from a renter, because it can only see the balance.

BonkDAO three weeks ago should worry you more, because it needed no flash loan. The attacker just bought the tokens: roughly $4M to move about $20M out of the treasury. When the vote is the only lock on the door, the price of the key is a market quote, and any treasury worth more than its own governance token is quoting a price to take it.

Gnosis is the version with no attacker at all. Holders moved to redeem the treasury because it was worth more than the token. The mechanism worked, and what it computed was that the organisation should stop existing.

Why these are structural

The common factor is that the voter does not bear the cost of being wrong. Governance specialists collect their payoff whatever happens to the protocol. Passive holders bear the outcome and have no governance payoff. Implementers bear the operational cost and hold no votes. Three exposures, one instrument that treats them identically because a balance is all it can read.

Michels reached the same place from trade unions in 1911. What the on-chain version adds is proof that the plumbing was never the problem, because we fixed the plumbing. Voting is nearly free, the ledger is public, and turnout is 8%.

The Circle result tells you where not to look. If concave curves reduce, the fix is not a better curve. It is in what the vote may touch, whether the outcome is the state change or a request for one, and whether a wrong voter loses anything. Those are the questions the tool asks.

The vote is not the decision. The decision is whatever the vote can still be routed around, and on current evidence that is most of it.

The Tool: the DAO Governance Failure Checker

Point it at a governance rule, or at a proposal written in ordinary prose, and it scores the rule against all four failure modes and tells you which one you are about to ship. Python, built on txtai. Full source below the cut.

Founder offer

Free: The Tape and The Read, every week, permanently.

Pro, $15 / mo or $250 / yr: The Brief, the tool's full source, the machine readable Feed, the archive.

Founder, $300 / yr, 100 seats: everything in Pro, plus the founders-only MCP server, built once all 100 seats are taken. The bar below is the live count of founding members. It reads zero because it is zero.

No pitch beyond that. The mechanism is the argument.