Compound’s $24M Vote Exposes DAO Governance Risk

Compound’s Proposal 289 passed after a late burst of support sent 682,191 votes against 633,636, authorizing the transfer of 499,000 COMP, then worth about $24 million, to a yield-bearing vehicle. Wallets behind the campaign had accumulated more than 682,000 COMP over four months, including tokens traced through centralized exchanges and COMP borrowed through Compound itself. The measure was later canceled through a settlement, and Compound added a veto role that gave the protocol an emergency brake.

Why it matters

The incident shows that a DAO can execute a treasury raid without exploiting a smart-contract bug. Researchers studying 28 DAO incidents classified 16 as attacks, including ten involving the purchase or borrowing of enough tokens to influence a vote. Registration, staking, and delegation are intended to prevent spam, make attacks more expensive, and give passive holders representation, but each can also concentrate practical authority.

Across 48 large Ethereum DAOs, 36 required some form of registration, yet only four registered more than half of their outstanding token supply. The average registered share was 21% among those 36 organizations. Fifteen DAOs required staking, with a median 27.4% of tokens locked, while delegation made voting power even more concentrated than direct voting in many cases.

The ten largest holders controlled more than half of voting power in 39 of the 48 DAOs. In 14 registration-based DAOs, exchange and DeFi intermediary wallets controlled more tokens than the entire registered electorate. Researchers also found that voting blocs associated with governance services could reach 53% of voting power in Curve, 46% in Frax, 57% in Angle, and 65% in Balancer.

Market impact

Protocols now face a design trade-off rather than a simple choice between decentralization and control. Extending voting periods, requiring longer staking, or giving a council veto authority can reduce late-stage attacks, but it also shifts influence toward committed holders, professional delegates, locking services, or a small emergency body. The researchers identified seven other DAOs with similar exposure to readily available voting power and late accumulation, including Uniswap, Radicle, Gitcoin, Silo, Ampleforth, Hop, and Cryptex.

The security question is therefore changing from whether governance code follows its rules to whom those rules distribute authority.