OAK — OnChain Attack Knowledge

Worked example · 2024-11

MakerDAO Endgame Snapshot governance legitimacy dispute — off-chain signal-vote treated as binding for multi-billion-dollar protocol restructuring — Ethereum — 2024-11

Loss
structural — no direct dollar extraction. The loss is measured in governance-legitimacy erosion: a contested Snapshot signal-vote whose outcome was treated as binding by the protocol's operators for a multi-billion-dollar protocol restructuring (the Endgame transition to NewChain / subDAO architecture) despite off-chain vote outcome disputes around voter-eligibility, voting-weight delegation concentration, and the binding-vs-signal status of Snapshot votes for treasury-level decisions. The governance-legitimacy loss is a T16.004 surface — off-chain Snapshot voting treated as binding for high-stakes protocol decisions where the on-chain governance path would have provided cryptographic finality.
OAK Techniques observed
OAK-T16.004 (Snapshot / Off-chain Voting Exploitation — the binding-status sub-pattern: the protocol's operators treated an off-chain Snapshot signal-vote as a binding governance mandate for protocol restructuring, converting a non-binding off-chain vote into de-facto on-chain execution via operator multisig. The Snapshot vote's outcome was contested on voter-eligibility and delegation-concentration grounds, but the dispute resolution surface was at the governance-forum / social-consensus layer rather than at the on-chain governance-contract layer). The case extends T16.004's coverage to the "high-stakes protocol restructuring via off-chain vote" sub-pattern alongside the Tornado Cash DAO extraction-scale anchor.
Attribution
unattributed — structural / governance-design-level. The dispute was between community governance participants and the protocol's operator/Foundation; no single attacker attribution is relevant.
Key teaching point
Treating off-chain Snapshot signal-votes as binding mandates for protocol-level restructuring converts a governance-legitimacy dispute into a protocol-level risk. The Snapshot vote is a signed-message aggregation — it has no on-chain enforcement, no cryptographic finality, and no timelock-protected execution path. When protocol operators treat the Snapshot outcome as a binding mandate and execute the outcome via operator multisig, the Snapshot vote's governance legitimacy becomes the sole load-bearing surface for a multi-billion-dollar protocol decision. Any dispute about voter eligibility, voting-weight anchoring, delegation concentration, or the vote's binding-vs-signal status becomes a protocol-level governance crisis — exactly the T16.004 surface.

Summary

MakerDAO's Endgame transition (2022–2025) involved a series of governance proposals restructuring the protocol's architecture — including the NewChain migration, subDAO formation, and treasury reallocation. During the Endgame governance process, multiple decisions were routed through Snapshot.org off-chain signal-votes whose outcomes the protocol's operators (the MakerDAO Governance Facilitator, the DAO's core unit structure, and later the Sky-brand transition governance) treated as binding mandates for on-chain execution via the protocol's multisig-operated administrative framework.

The governance-legitimacy dispute centred on the binding-vs-signal status of Snapshot votes for treasury-level decisions. The MakerDAO governance framework included both on-chain governance (the Maker Governance contract, with executive vote and the GSM Pause Delay as the timelock-equivalent) and off-chain Snapshot signal-votes (used for temperature-checks, community sentiment, and non-binding signalling). The Endgame transition's reliance on Snapshot signal-votes for decisions that triggered multi-billion-dollar treasury reallocations, subDAO formations, and the rebranding to Sky blurred the boundary between "signal vote" and "binding mandate." Community participants disputed whether specific Snapshot outcomes — particularly those with contested voter-eligibility, delegation-concentration, or quorum-participation questions — should bind the protocol's operators to execute the outcome on-chain.

The dispute is the canonical 2024 T16.004 binding-status sub-pattern: the Snapshot vote is technically non-binding (signed messages, no on-chain enforcement), but the protocol's operators treat it as binding and execute via multisig, and the governance-legitimacy of that execution is the sole load-bearing surface. The Tornado Cash DAO case (2023-05) is the extraction-scale T16.004 anchor (Sybil-cluster Snapshot vote → on-chain treasury extraction); the MakerDAO case is the legitimate-but-contested T16.004 anchor (legitimate governance process → Snapshot signal-vote treated as binding → governance-legitimacy dispute at the social-consensus layer).

Timeline (UTC)

When Event OAK ref
2022-05 MakerDAO Endgame proposal published; multi-year protocol restructuring begins (Endgame initiation)
2023–2024 Endgame governance decisions routed through Snapshot signal-votes; operator multisig executes Snapshot-endorsed actions on-chain T16.004 (binding-status sub-pattern)
2024-08 MakerDAO rebrands to Sky; the rebranding governance process surfaces binding-vs-signal questions about the Snapshot votes that endorsed the transition T16.004 (governance-legitimacy dispute)
2024-11 Community governance disputes about Snapshot vote binding-status, voter-eligibility, and delegation concentration continue; the Endgame transition proceeds via operator-multisig execution of Snapshot-endorsed decisions T16.004 (standing surface)
Continuing The binding-vs-signal boundary for Snapshot votes in MakerDAO/Sky governance remains contested through v0.1 T16.004 (structurally open)

What defenders observed

  • The binding-vs-signal boundary is the load-bearing T16.004 governance-design question. MakerDAO's governance framework included both on-chain and off-chain paths; the Endgame transition's reliance on Snapshot signal-votes for high-stakes decisions blurred the boundary. Defenders evaluating any DAO's governance should explicitly assess: which decisions are routed through on-chain governance (with cryptographic finality) and which are routed through off-chain Snapshot votes (with social/operational enforcement)? Are the off-chain votes documented as "signal" (non-binding) or "binding" (operator-committed-to-execute)? The boundary between the two is the T16.004 surface.
  • The legitimate-but-contested T16.004 sub-pattern is structurally different from the adversarial T16.004 sub-pattern. The Tornado Cash DAO case is adversarial (Sybil-cluster Snapshot vote → treasury extraction). The MakerDAO case is legitimate-but-contested (governance process produces a Snapshot outcome → community dispute about the outcome's binding status → operator-multisig execution despite the dispute). Both sub-patterns share the same structural observation — off-chain Snapshot votes without cryptographic finality treat the operator's commitment to execute as the load-bearing surface — but the mitigation ladders differ: the adversarial case is mitigated by Sybil-resistance and voter-eligibility anchoring; the legitimate-but-contested case is mitigated by governance-process clarity about which decisions require on-chain finality.

Public references

  • [makerdaoendgame2022] (proposed) — MakerDAO Endgame proposal and governance-process documentation.
  • [makerskytransition2024] (proposed) — MakerDAO-to-Sky rebranding governance process and the binding-vs-signal boundary question.
  • [snapshotmakerdao] (proposed) — MakerDAO Snapshot space; the signal-vote record for Endgame-related decisions.

Discussion

The MakerDAO Endgame Snapshot governance dispute is the fourth T16.004 worked example and anchors the legitimate-but-contested binding-status sub-pattern alongside the adversarial extraction-scale anchor (Tornado Cash DAO, 2023-05). The structural observation — off-chain Snapshot signal-votes treated as binding mandates for multi-billion-dollar protocol decisions concentrate governance legitimacy on the operator's commitment to execute rather than on cryptographic finality — establishes T16.004 as a governance-design Technique rather than merely an attack-classification Technique. The binding-vs-signal boundary is the load-bearing governance-design question, and the MakerDAO case demonstrates the governance-legitimacy erosion that occurs when the boundary is blurred at the multi-billion-dollar protocol scale.

Techniques demonstrated (1)