DAOs

Smart Contracts, DeFi & Web3 Security

Course 2 · Chapter 6 · DAOs: Decentralized Autonomous Organizations

Course 1 Chapter 6 and this course's own Chapter 3 both revisited "The DAO" — the specific 2016 project whose real reentrancy exploit is now a permanent part of blockchain history. This chapter covers a DAO as a general, ongoing organizational pattern — one that genuinely survived that disaster and is still actively used today, with its own real successes, real failures, and real, unresolved governance problems.

What a DAO Actually Is

A Decentralized Autonomous Organization (DAO) is an organization whose own governance rules — how decisions get made, and how its own treasury gets spent — are encoded directly in smart contracts, rather than run by a traditional board or management hierarchy. In practice, this almost always means token-weighted governance: members propose changes, and holders of the organization's own governance token (an ERC-20 token, per Course 1 Chapter 8, just used for voting rights rather than as a currency) vote on-chain, with voting power typically proportional to how many tokens each address holds.

MakerDAO: A Real, Established Example

MakerDAO, launched in December 2017, is one of the oldest and most significant real DAOs still operating today — its holders govern the real parameters behind DAI, a decentralized stablecoin, and the lending mechanisms that back it. Unlike the original 2016 DAO, MakerDAO has operated continuously for years, a real, concrete demonstration that the underlying pattern itself wasn't the problem in 2016 — a specific, exploitable piece of code was (Chapter 3).

ConstitutionDAO: A Real, Fully Documented Case Study

A genuinely different kind of DAO, and a real, complete story worth knowing in full — both for its remarkable success and its own honest, practical failure.

Nov 2021

ConstitutionDAO forms almost overnight, crowdfunding ETH from thousands of strangers with one shared goal: bidding on an original, first-edition copy of the U.S. Constitution at a real Sotheby's auction. It raises a real $47 million, with a median individual contribution of roughly $217.

Auction day

ConstitutionDAO loses the auction — billionaire Kenneth C. Griffin outbids the group at $43.2 million. The organizers, weighing the real added costs of insurance, storage, and transport on top of any further bid, decide not to raise their offer.

Weeks later

The DAO disbands and tries to refund every contributor — and runs directly into Chapter 2's own gas-fee reality at real scale: some contributors paid a real $70 in gas fees just to donate or withdraw as little as $200, and roughly $23 million remained genuinely unrefunded weeks after the auction ended, purely because of the accumulated real cost of processing thousands of individual on-chain refund transactions.

A Real, Honest, Slightly Absurd Postscript Despite the failed mission and the messy refund process, ConstitutionDAO's own now-worthless- seeming governance tokens later became collectible in their own right, with a real, reported total value around $300 million at one point — a genuinely strange, real illustration that a token's own market price and its underlying project's actual real-world success can come apart entirely.

Multisig Treasuries: A More Robust Access-Control Pattern

A DAO's own treasury — potentially millions of dollars in pooled funds — is rarely guarded by a single Chapter 3-style onlyOwner address. Instead, real DAOs almost universally use a multisig wallet, requiring a real, defined threshold of signatures (commonly written as "M-of-N," e.g. 4-of-7 trusted signers) before any transaction can actually execute. Safe (formerly known as Gnosis Safe) is the real, dominant, widely used multisig implementation on Ethereum today.

This is a direct, practical extension of Chapter 3's own access-control discussion: rather than trusting one single private key (a genuine single point of failure), a multisig spreads that trust across several independent keys, so no single compromised or malicious signer can move funds alone.

Real, Honest Legal Status

A DAO's actual legal status remains genuinely unclear in most jurisdictions worldwide — a DAO with no formal legal wrapper can, in some interpretations, functionally expose its own individual members to unlimited liability as an unincorporated general partnership, since there's no recognized corporate structure shielding them. Wyoming was the real, first U.S. state to address this directly, passing a law effective 1 July 2021 that legally recognizes DAOs organized as LLCs — with the American CryptoFed DAO receiving the first real, formal recognition under it. This remains a genuinely unsettled area of law almost everywhere else.

Real, Honest Governance Challenges

Challenge	Why It's Real
Plutocracy	Token-weighted voting means influence concentrates wherever token holdings concentrate — the same dynamic Chapter 4's own DeFi coverage applies to money applies equally to governance power
Voter apathy	Many token holders simply don't vote on most real proposals, letting a small, active minority effectively decide outcomes for everyone
Legal exposure	Outside jurisdictions like Wyoming, members may carry real, unclear personal liability

The Honest Takeaway A DAO genuinely does remove a traditional company's own board and management hierarchy — but it doesn't automatically remove the underlying human problems those structures existed to manage (concentrated power, disengaged stakeholders, unclear accountability). It relocates them into a different, code-enforced system, with its own real, different set of trade-offs, rather than eliminating them outright.

Hands-On Exercises

Three exercises applying this chapter's real DAO examples and governance critiques, before Chapter 7 turns to smart contract security vulnerabilities in full depth.

Exercise 1

Using this chapter's own MakerDAO example, explain why MakerDAO's own continued operation since 2017 is real evidence against the claim that "the 2016 DAO hack proved DAOs themselves are fundamentally unsafe."

→ Solution

Exercise 2

Using this chapter's own ConstitutionDAO refund problem and Chapter 2's own gas-fee material, explain specifically why refunding thousands of small individual contributions on-chain was more expensive, proportionally, than refunding a smaller number of large contributions would have been.

→ Solution

Exercise 3

Explain, using this chapter's own multisig explanation and Chapter 3's own access-control material, why a 4-of-7 multisig is generally considered safer for a DAO treasury than a single onlyOwner address — and name one real trade-off this added safety comes with.

→ Solution

Quick Reference

DAO — an organization governed by on-chain, token-weighted voting instead of a traditional board.
MakerDAO — launched December 2017, governs the DAI stablecoin, a real, long-running counter-example to "DAOs are inherently unsafe."
ConstitutionDAO — November 2021, raised $47M, lost the Constitution auction at $43.2M, then hit real gas-fee refund problems (some paying $70 in fees on $200 donations).
Multisig (Safe/Gnosis Safe) — requires M-of-N signatures for a treasury transaction, spreading trust beyond a single key.
Legal status — generally unclear worldwide; Wyoming's 1 July 2021 law was the real first US recognition of DAO LLCs.
Real governance challenges — plutocracy (token-concentrated power) and voter apathy.