SoK: Attacks on DAOs

TL;DR

This paper systematically analyzes security threats to DAOs, categorizing attack vectors, examining past and potential attacks, and proposing mitigation strategies to enhance DAO security.

Contribution

It provides a comprehensive categorization of DAO attack vectors, analyzes empirical data on vulnerabilities, and offers insights into mitigation strategies.

Findings

Many attacks exploit human governance complexities

Audits focus more on code than human factors

Empirical data reveals common vulnerability patterns

Abstract

Decentralized Autonomous Organizations (DAOs) are blockchain-based organizations that facilitate decentralized governance. Today, DAOs not only hold billions of dollars in their treasury but also govern many of the most popular Decentralized Finance (DeFi) protocols. This paper systematically analyses security threats to DAOs, focusing on the types of attacks they face. We study attacks on DAOs that took place in the past, attacks that have been theorized to be possible, and potential attacks that were uncovered and prevented in audits. For each of these (potential) attacks, we describe and categorize the attack vectors utilized into four categories. This reveals that while many attacks on DAOs take advantage of the less tangible and more complex human nature involved in governance, audits tend to focus on code and protocol vulnerabilities. Thus, additionally, the paper examines empirical data on DAO vulnerabilities, outlines risk factors contributing to these attacks, and suggests mitigation strategies to safeguard against such vulnerabilities.