I often start governance audits the same way I start any research project: with a clear question and a list of measurable signals. For crypto projects, that question usually sounds like: "Can token holders meaningfully influence protocol direction, and is the treasury managed transparently and responsibly?" Over the years I’ve developed a pragmatic checklist that combines on-chain vote analysis with treasury signal tracking. Below I share the step-by-step approach I use to assess governance health, the concrete on-chain tools I rely on, and red flags that have repeatedly predicted governance failure or centralization risk.
Why on-chain votes and treasury signals matter
Governance is more than governance tokens or on-paper DAOs. Real power lives in the combination of voting mechanics and the treasury — the resources that fund development, incentives, grants, and emergency responses. Strong voting procedures with a mismanaged treasury can still end badly (e.g., funds drained or misallocated). Conversely, a well-funded treasury run by a small centralized group undermines the stated decentralization. I focus on both because together they reveal who actually controls outcomes and resources.
Initial reconnaissance: where I begin
My first steps are always low-friction and on-chain:
Check the governance forum and Snapshot page for active proposals and historical turnout.Pull the token contract and token distribution from Etherscan/Polygonscan or equivalent to map largest holders and smart contracts.Inspect treasury addresses and multisigs (often Gnosis Safe) via block explorers and analytics tools.These steps let me build a quick hypothesis: is participation healthy? Are there obvious whales or single points of control? Is the treasury concentrated in a few addresses or spread across protocols and stablecoins?
On-chain vote signals I analyze
When I audit on-chain governance, I look at a set of measurable vote signals that together tell a story:
Turnout and engagement: absolute voter count and percentage of circulating supply participating. Low turnout (e.g., <1–2%) suggests governance capture or apathy.Vote concentration: how much voting power do top 10 addresses control? If a handful of wallets control >50% of voting power, the governance is effectively centralized.Proposal origin and proposer diversity: are most proposals coming from a small group (core team or a handful of delegates)? Healthy projects show diverse proposers.Delegation patterns: follow the flow of delegated votes. Large delegations to a few delegates indicate representative governance but also risk of cartel-like behavior.Proposal passage velocity: frequency and success rate of proposals. Rapid, unchecked changes or excessive churn can signal instability or governance takeover attempts.Voting token utility vs. capture: analyze whether tokens granting votes are also used for yield or staking. Dual-use increases incentive to retain control.Practically, I extract this data via Snapshot, The Graph queries (for on-chain DAOs), Dune dashboards from the community, and direct contract reads. Snapshot gives a quick view of engagement and delegation; Dune lets me slice by address, time, or proposal type; Etherscan helps verify wallet ownership or link addresses to exchanges.
Treasury signals I track
The treasury is the DAO’s balance sheet. My audit focuses on composition, movement, and custodial control.
Asset composition: percentage in stablecoins, native tokens, LP tokens, NFTs, or illiquid positions. A healthy treasury typically keeps a meaningful stablecoin buffer for runway and operations.Exposure to single assets or protocols: concentrated holdings (e.g., 60% in one volatile token) are risky.Inflows and outflows: frequency and size of transfers. Sudden large transfers to exchanges or unknown wallets are immediate red flags.Spending transparency: do treasury transactions reference proposals or budgets? Unlinked spending implies opacity.Custody and multisig structure: number of signers, use of timelocks, and any listed emergency powers. Single-signer treasuries or multisigs lacking clear signers are risky.Third-party exposure: funds in CeFi exchanges, custodians, or risky lending platforms—these create off-chain counterparty risk.I use on-chain explorers and analytics platforms like Nansen, Zapper, and Zerion to visualize treasury composition. For deeper forensic work, I map flows with Blockchair or use Tenderly/Alchemy to trace contract interactions. If the treasury holds LP tokens, I investigate underlying pools to assess impermanent loss and liquidation risk.
Red flags and patterns that matter
Over the years I’ve seen the same failure modes repeat. These are the things that make me stop and dig deeper:
Low quorum but high pass rates: when proposals win with minimal participation, it often means whales or core teams are pushing changes without community consent.Votes correlated with on-chain transfers: if voting occurs right after token transfers into a small set of wallets, it may indicate vote-buying or vote renting.Treasury transfers to exchanges: significant transfers to centralized exchanges (Coinbase, Binance) usually precede sell pressure or fund extraction.No timelock or short timelocks: proposals that can be executed immediately give proposers emergency power to change contracts before the community can react.Opaque multisig signers: lack of public signers or signers that are contract addresses complicates accountability.Repeated centralization of delegation: where delegation is concentrated with a few "delegates" who never change their votes regardless of community sentiment.Actions and verification steps I perform
Audit findings should be reproducible. Here’s the practical checklist I use to verify signals and document risk:
Export vote data from Snapshot or governance contract and compute turnout and concentration metrics. I often create a simple Dune dashboard for new projects.Trace major treasury transfers and label counterparties (exchanges, DeFi protocols, multisigs) using Nansen or on-chain labeling repositories.Check proposal metadata: linked off-chain discussions, IPFS docs, and budget line items. If proposals lack context, I flag them.Simulate worst-case scenarios: e.g., what happens if the top 3 voters collude? Can they upgrade contracts? Can they drain the treasury? I look for admin keys and timelock gaps.Review vesting schedules and liquidity mining contracts. Unreleased tokens controlled by insiders are a future governance and dilution risk.Tools and templates I recommend
Here are the tools I use regularly and a simple template I share with teams:
Snapshot — vote history, delegation graph.Dune Analytics — custom dashboards for turnout, top voters, proposal timelines.Nansen / Zapper / Zerion — wallet labeling and treasury composition.Etherscan/Polygonscan — contract reads, token holders export.Gnosis Safe Explorer & Safe Transaction Service — multisig activity and signer lists.Template (quick):
| Signal | Metric | Threshold / Flag |
| Turnout | % of circulating supply | <2% — caution |
| Top holder concentration | Top 10 holders % | >50% — high centralization |
| Treasury stablecoins | % stable vs total | <20% — runway risk |
| Timelock | Delay length | None or <24h — critical risk |
How I present findings to teams or readers
I prioritize clarity: lead with the most actionable risks (e.g., "Top 3 addresses control 62% of voting power" or "Treasury moved $5M to Binance last week without linked proposal"). I provide visual evidence (tx links, Snapshot IDs, Dune charts) and recommend mitigations like increasing timelocks, diversifying treasury holdings into stable reserve, introducing minimum quorum rules, or requiring multisig signers to be public and independent.
Auditing governance is iterative. On-chain signals give you objective data, but the nuance comes from combining those signals with on-chain history and off-chain context (team statements, audits, partnerships). When readers ask me whether a DAO is "safe," I respond with a quantified risk profile, not a binary judgment — and I always include the concrete steps the project can take to reduce the biggest risks I identified.
