top of page

Can a Wyoming DUNA Stop a Governance Attack by Your Own Token Holders?

Writer: Dustin Slade
Dustin Slade
Sep 30
8 min read

On Sunday, July 28, 2024, Compound's governance contract did exactly what it was built to do. Proposal 289, which would have moved 499,000 COMP, then worth roughly $24 million, out of the protocol's reserves and into a yield product run by a voting bloc that called itself the Golden Boys, passed by 682,191 votes to 633,636. Eighty-two percent of the winning votes arrived in the final thirty-four minutes. Nothing was hacked. No signature was forged.


Every rule in the code was followed, and the community spent the next two days negotiating with the people who had followed it, who agreed to cancel the allocation in exchange for a commitment to develop a new staking product that would route thirty percent of market reserves to COMP stakers. Within weeks, the community was debating whether to hand a multisig the power to cancel proposals like the one that had just passed.


That sequence is the whole problem in miniature. A governance attack is not a bug. It is a valid vote whose outcome the rest of the membership regards as capture or self-dealing, and code cannot tell the difference, because from the code's point of view there is no difference.


This piece covers three things: (1) why code alone cannot solve a problem that code did not cause; (2) what a Wyoming DUNA actually changes, provision by provision, and what it does not; and (3) the tradeoff you take on when you bolt an emergency brake onto a decentralized organization, and what your governing documents should say about it.


Why the Ballot Box Is Not the Constitution


A governance contract is a ballot box. It counts; it does not judge. You can, and should, make the box harder to stuff. A timelock between passage and execution makes a bad outcome visible before it is final. A proposal threshold keeps every passing wallet from putting the treasury on the ballot. A vote-extension rule of the kind OpenZeppelin publishes as GovernorPreventLateQuorum pushes the voting deadline out whenever a vote tips a proposal over quorum, so a last-minute reversal has to survive a reaction. Each of these raises the cost of capture. None of them changes what capture is. A patient bloc that accumulates tokens over months, as the wallets behind Proposal 289 reportedly did, simply pays the higher price and votes anyway.


Build Finance DAO learned the other half of the lesson in February 2022, when a single holder used a large token position to pass a proposal handing themselves the governance contract, the minting keys, and the treasury, then drained roughly $470,000. The episode illustrates a harder problem: without a statutory entity and governing principles that clearly separate authorized governance from prohibited self-dealing, identifying the plaintiff, the defendant, the applicable duties, and the legal basis for recovery can become considerably more difficult. Code supplied an answer to who controlled the assets. It did not supply an answer to what legal obligations accompanied that control.


Code decides what can pass. Law decides what it means. A legal wrapper does not create that second question, but it can make the answer dramatically clearer.


What a Wyoming DUNA Changes


Wyoming's Decentralized Unincorporated Nonprofit Association Act gives an unincorporated association of at least one hundred members, joined by mutual consent for a common nonprofit purpose, a legal existence separate from its members. Three of its provisions bear directly on treasury capture.


First, the treasury is not the members' to divide. The Act permits a DUNA to engage in profit-making activity, but profits must be used in furtherance of, or set aside for, the common nonprofit purpose, and the association may not pay dividends or distribute any part of its income or profits to members, administrators, or anyone else. The carve-outs are specific: reasonable compensation for services rendered, expressly including voting or participation in the association's activities; benefits conferred on members in conformity with the nonprofit purpose; repurchases of membership interests where the governing principles allow; and distributions on winding up. So a proposal whose function is simply to distribute the association's income or profits to a subset of members cannot become permissible merely because it won a governance vote. Unless the payment fits one of the Act's exceptions—including a benefit conferred in conformity with the common nonprofit purpose—the statute prohibits it. A constitution outranks a referendum. The line between "conferring benefits in conformity with the nonprofit purpose" and "distributing profits" is where the arguments will live; your governing principles should draw it before an adversary draws it for you.


Second, every member owes good faith. The Act provides that a member has no fiduciary duty to the association or the other members solely by reason of being a member, but that all members are subject to the implied covenant of good faith and fair dealing. No court has applied that covenant to a quorum-capture vote, and this piece does not predict how one would. But coordinated self-dealing of that kind is the sort of conduct that could implicate the covenant, depending on the DUNA's governing principles, common purpose, and the members' justified expectations. In an unwrapped DAO, the existence and source of comparable duties may be considerably less clear and may depend on how the DAO is characterized under applicable law.


Third, there is now someone who can sue. A DUNA may institute, defend, intervene in, or participate in judicial and administrative proceedings in its own name, and a judgment against the association is not, on that basis alone, a judgment against a member or administrator. The uncertainty over who may sue in the association's name is substantially reduced. The governing principles can also, if set out in a record, limit an administrator's monetary liability to the association or its members, subject to statutory exceptions for improper financial benefit, intentional harm, intentional criminal violations, certain breaches of a duty of loyalty where one exists, and improper distributions.


Now the other side of the ledger. The DUNA is not a circuit breaker. If the code allows the transfer, the transfer executes; the statute operates afterward, in a courtroom, against whoever can be identified and reached. A claim is worth what the defendant is worth and where the defendant is, and a pseudonymous bloc voting from wallets funded through an exchange is a harder target than a name on a cap table. A judgment from a Wyoming or federal court also has to be enforced wherever the defendant's assets sit, which is a question for counsel licensed in that jurisdiction. The DUNA does not make capture impossible. It can make the legal basis for pursuing it considerably clearer. Those are different things, and the difference is priced in lawyers' hours.


The Emergency Brake and Its Price


Compound's community answer was a proposal to make its four-of-eight community multisig a "Proposal Guardian," a last line of defense able to cancel a malicious proposal before execution. It is a sensible answer. It is also a tradeoff, and the tradeoff should be made with eyes open.


An emergency brake is a hand on the wheel, and a hand belongs to someone. A handful of identifiable persons with the power to override a valid vote is precisely what regulators and plaintiffs look for when they argue that a network is not really decentralized. Under the DUNA Act those persons are almost certainly administrators, defined as persons authorized by the members to fulfill administrative or operational tasks at the direction of the membership. That is fine, and the governing principles can provide them substantial protection from monetary liability within the limits the Act permits, but it also makes them identifiable institutional actors—and potentially persons through whom the association may be served—even if the Act does not thereby make them personally liable. They are also the ones whose keys an attacker will target next. A brake that can stop a capture can itself be captured.


Wyoming's DAO LLC statute makes the same point from the other direction. It provides that management is vested in the members, or in the members together with any applicable smart contracts, and the articles must establish how the DAO is managed, including the extent to which management is algorithmic. That framework can accommodate an emergency governance role. It also sets a hierarchy: the smart contract preempts conflicting provisions of the articles, with narrow exceptions, and the articles preempt the operating agreement. A brake that lives only in your documents loses to the code the moment they disagree. A brake that lives only in your code operates without any standard for when it may be pulled. Put it in both, and make the documents say what the code cannot.


For a DUNA, whose governing principles expressly include its agreements, consensus formation algorithms, and smart contracts, and which may adopt and, by its own stated procedures, modify the algorithmic means by which it makes decisions, that means, non-exhaustively:

  1. Bind the parameters. State that the timelock, quorum, proposal threshold, and any vote-extension rule are part of the governing principles, and that a transaction executed in violation of them is unauthorized. This turns a code setting into a promise.

  2. Name the brake narrowly. Who holds it; what triggers it; the standard for pulling it; a duty to report to the membership; and a sunset, such as member ratification within a stated period, failing which the cancelled proposal may be re-run and the guardians may be removed. Emergency powers that never expire are not emergency powers. They are the government.

  3. Define the distribution line. Say in advance what counts as reasonable compensation, what counts as a benefit conferred in furtherance of the purpose, and what does not, so the statute's prohibition has a definition to attach to when it matters.

  4. Pre-authorize the response. Say who may retain counsel and pursue recovery on the association's behalf without a full governance vote. Litigation deadlines are measured in days. Governance cycles are not.


None of this requires a DUNA per se; a DAO LLC's articles and operating agreement can carry the same terms. What it requires is a legal and governance structure capable of making those terms meaningfully binding.


The Point


The Compound episode ended in a negotiated settlement because, with the vote already counted, persuasion and a counteroffer were the tools the community had. Every DAO that has not yet been captured is running the same experiment with the same tools. The technical fixes are worth adopting, but they raise the price of a capture rather than changing its character, and the emergency brake that stops one comes with a hand attached. The question a Wyoming DUNA makes much easier to ask is not whether the vote was valid. It is whether the act was authorized. An unwrapped DAO may face that question too, but the DUNA supplies an entity, governing-law framework, and legally recognized governing principles through which to answer it. The next governance attack will land on a DAO that has both a ballot box and a constitution, and the outcome will turn on whether the two were drafted to say the same thing.


References


 
 
 

Comments

bottom of page