Skip to content
DeFi Reference

Governance and tokenomics

1. TL;DR

Section titled “1. TL;DR”

On-chain governance is a trade-off: it lets a protocol adapt, but every formal governance mechanism is also an attack surface and a source of value misalignment between short-term token holders and the protocol’s long-term users. Ethereum’s application layer has experimented widely with tokenholder voting, vote-escrow, and fee switches, while its base layer stays deliberately governance-minimized; Solana governs its base layer through validator-stake-weighted feature-gate votes (SIMDs) rather than a tokenholder DAO, while its application layer (Jupiter and others) has leaned instead into revenue-funded token buybacks as a substitute for classic governance rights.

2. Explain it simply

Section titled “2. Explain it simply”

Analogy

Section titled “Analogy”

Running a protocol’s governance is like writing the bylaws for a condo building. You want enough rules that residents can fix a broken elevator or evict a tenant who’s flooding the hallway, but if you let any resident vote to change anything, including the building’s foundation, a slim, temporary majority can vote to spend the reserve fund on a rooftop pool and stick everyone else with the bill. The healthiest buildings write down, in advance, which decisions residents get to vote on and which parts of the building are simply off-limits to any vote at all.

ELI5

Section titled “ELI5”

A blockchain project needs some way to decide things: which features to add, how to spend a shared treasury, or how to fix a bug. One option is to let people who hold the project’s token vote on every decision. That sounds fair, but it has a catch: someone can borrow a huge pile of tokens for a single day, just to win one vote, then give the tokens back — winning without ever really having a stake in the outcome. Because of this, many projects try to make as few decisions “votable” as possible, lock the important rules in code no vote can touch, and only let token holders decide things that genuinely need a human judgment call.

Step-by-step walkthrough

Section titled “Step-by-step walkthrough”

Scenario: Curve’s DAO runs a weekly vote to decide which liquidity pools receive newly issued CRV tokens (“gauge weight voting”).

  1. Locking (before: 1,000 liquid CRV tokens → after: 1,000 CRV locked, non-transferable “veCRV” voting power). A user locks CRV for four years, the maximum, and receives voting power equal to the full locked amount.
  2. Decay begins (before: full voting power → after: voting power falling every week). From the moment of locking, that voting power decays linearly toward zero as the four-year unlock date approaches — a user who instead locked for only one year would have started with just one-quarter of the voting power for the same 1,000 CRV.
  3. The weekly vote (before: emissions split according to last week’s weights → after: emissions redirected). veCRV holders vote on how much of the week’s new CRV issuance each liquidity pool should receive; a pool with more votes attracts more liquidity providers, because they can earn issuance rewards on top of trading fees.
  4. Bribery markets react (before: votes reflect only “genuine” preference → after: some votes are purchased). Third-party marketplaces let anyone pay veCRV holders directly to vote for a specific pool, since directing emissions to a pool can be worth far more to an outside protocol than the cost of buying the votes.

Common misconceptions

Section titled “Common misconceptions”
  • Myth: More on-chain governance means a more decentralized, trustworthy protocol. Reality: Formalizing “who gets a vote” is itself a hard, permanent decision, and Fred Ehrsam argues formal voting systems tend to become more, not less, susceptible to capture over time as the group of real stakeholders drifts away from the group of token holders (Ehrsam, Paradigm, 2020-10).
  • Myth: Token-holder voting is inherently democratic. Reality: Flash loans let an attacker borrow tokens to win a single vote and repay within the same transaction, with no genuine economic exposure — a vulnerability “already worked” against a live protocol before this framework was written (Ehrsam, 2020-10).
  • Myth: Locking tokens for governance (“vote-escrow”) is mainly about voting. Reality: On Curve, locked veCRV also controls a boost multiplier on a liquidity provider’s own trading-fee and reward rate, so the lock is as much an economic commitment device as a political one.
  • Myth: Solana has no protocol governance because there’s no DAO for the base layer. Reality: Solana Improvement Documents (SIMDs) are adopted through validator stake-weighted feature-gate activation — a form of governance, just one where voting power tracks validator stake rather than a separate governance token.

If you only remember one thing

Section titled “If you only remember one thing”

The less a protocol needs a vote to function correctly, the more people can trust it — so the central design question in both governance and token distribution is which decisions truly need a human judgment call, and which ones should simply be coded in and left alone.

3. How it works

Section titled “3. How it works”

Essential vs inessential governance

Section titled “Essential vs inessential governance”

Ehrsam separates essential governance — decisions genuinely requiring human judgment that can’t be derived from on-chain data, such as which of two valid chain histories to follow, or whether an oracle’s price is correct — from everything else, which protocols should progressively remove from human votes wherever a mechanical rule can substitute (Ehrsam, Paradigm, 2020-10). Treasury management and complex parameter-setting (which collateral a lending protocol accepts) sit in a gray zone: “likely required for the foreseeable future” for lack of a mechanical substitute, but not essential the way consensus itself is.

Vote-escrow: locking as a costly signal

Section titled “Vote-escrow: locking as a costly signal”

Curve’s vote-escrowed CRV (veCRV) ties voting power to a token lock with linearly decaying weight. Locking amount aa with TT time remaining until a maximum lock length TmaxT_{max} (four years on Curve) gives initial voting power w0=a⋅TTmaxw_0 = a\cdot\dfrac{T}{T_{max}}, decaying linearly to zero as unlock approaches — “one CRV locked for four years provides an initial balance of one veCRV,” decaying “as the remaining time until the CRV unlock decreases” (Curve documentation, accessed 2026-08). Hence “4000 CRV locked for one year provides the same amount of veCRV as 2000 CRV locked for two years, or 1000 CRV locked for four years” (Curve documentation, accessed 2026-08) — an identical voting-power-over-time budget, spent as a large amount briefly or a small amount for longer. veCRV controls two things at once: weekly “gauge weight” votes on which pools receive CRV emissions, and a boost multiplier on the holder’s own LP rewards — the latter gives the lock economic teeth beyond pure governance.

Vote markets, bribes, and DAICOs

Section titled “Vote markets, bribes, and DAICOs”

Because gauge votes redirect real value that liquidity providers price into where they deploy capital, a market for renting veCRV voting power emerged: protocols pay veCRV holders directly through “bribe” marketplaces (historically Votium, and aggregators like Convex that pool veCRV itself) to direct emissions their way. This is structurally the same vote-buying dynamic Ehrsam warns about in the abstract, just made explicit and priced rather than hidden — arguably healthier, since it makes the true cost of influence legible instead of concealed.

Buterin’s DAICO proposal applies the same “minimize what needs a vote” logic to fundraising. A DAICO holds raised funds behind a tap — a withdrawal rate, initialized to zero — that token holders can vote to raise (never to lower unilaterally; only the team may voluntarily lower its own rate) or to permanently self-destruct, returning remaining funds pro-rata (Buterin, ethresear.ch 465, 2018-01). This narrows governance to exactly two hard-to-abuse actions — approve more spending, or shut down and get money back — deliberately ruling out the two most damaging attacks (redirecting funds elsewhere, or freezing them forever) by construction.

Fee switches and buybacks as value capture

Section titled “Fee switches and buybacks as value capture”

A fee switch is a governance-controlled toggle redirecting a share of protocol revenue — previously paid entirely to liquidity providers — toward token holders, typically via burns. Uniswap passed its “UNIfication” fee-switch with 99.9% support in December 2025, burning 100 million UNI after a two-day timelock (CoinDesk, secondary, 2025-12). Deciding whether and how much value to redirect is essential governance in Ehrsam’s sense — it can’t be derived mechanically. Some Solana apps skip the vote and buy back programmatically instead: Jupiter directs 50% of revenue to buy back and lock JUP for three years in its “Litterbox Trust” (~96–113 million JUP held, ~5.6% of supply at its 2025 peak, secondary); Hyperliquid — a separate, non-Solana exchange cited alongside Solana DeFi as a comparable model — routes 97–99% of fees into a fund that had spent over $1.3 billion on HYPE as of 2026-05 (secondary), no vote per purchase.

4. Worked numeric example

Section titled “4. Worked numeric example”

veCRV lock, matching §2. With Tmax=4T_{max}=4 years: locking a=1,000a=1{,}000 CRV for the full 4 years gives w0=1,000×44=1,000w_0 = 1{,}000\times\frac{4}{4}=1{,}000 veCRV. Locking the same 1,000 CRV for only 2 years gives w0=1,000×24=500w_0 = 1{,}000\times\frac{2}{4}=500 veCRV — half the voting power for the identical token amount, because the commitment is shorter. After 1 year has passed on the 4-year lock (3 years remaining), voting power has decayed linearly to 1,000×34=7501{,}000\times\frac{3}{4}=750 veCRV. This is exactly why “4000 CRV locked for one year provides the same amount of veCRV as 2000 CRV locked for two years, or 1000 CRV locked for four years” (Curve documentation, accessed 2026-08): 4,000×14=1,0004{,}000\times\frac{1}{4}=1{,}000; 2,000×24=1,0002{,}000\times\frac{2}{4}=1{,}000; 1,000×44=1,0001{,}000\times\frac{4}{4}=1{,}000 — all three produce identical initial voting power.

DAICO tap, matching §3. A team raises the ETH-equivalent of $10 million and sets an initial tap of 0; holders then vote to approve a tap of t=5,000t=5{,}000 currency units per day (roughly $150,000/month). Drawing down for 182 days without a further vote withdraws t×182=910,000t\times182=910{,}000 units — about $910,000 — leaving roughly $9.09 million still locked. Unhappy holders can vote to self-destruct and recover that $9.09 million pro-rata, but cannot redirect it elsewhere or lower the tap themselves (only the team can do that voluntarily) — exactly why the two most damaging attacks Buterin flags, redirection and permanent freezing, are structurally unavailable to a hostile voting majority.

5. Where it’s used

Section titled “5. Where it’s used”

Ethereum

Section titled “Ethereum”
  • Compound, Uniswap, MakerDAO/Sky — canonical tokenholder-voting DAOs governing parameters, treasury spend, and (Uniswap, as of December 2025) a protocol fee switch.
  • Curve DAO (veCRV) — vote-escrow governing gauge-weight emissions and LP reward boosts (§3–4 above); bribe markets (Votium, Convex) have grown around it. Curve documentation
  • DAICOs — proposed 2018 as a fundraising-governance hybrid; limited direct production adoption, but its capped, revocable-spending idea influenced later designs. See /exchange/bonding-curves-and-launches/ for related distribution mechanisms (GDA, VRGDA).
  • Uniswap “UNIfication” fee switch — passed December 2025, 99.9% support, burning 100 million UNI. CoinMarketCap

Solana

Section titled “Solana”
  • SIMD process — protocol changes (e.g. the issuance reforms in /staking/issuance-and-staking-economics/) go through validator stake-weighted feature-gate activation, not a tokenholder DAO; SOL carries no formal on-chain vote over the base protocol.
  • Jupiter DAO and the Litterbox Trust — JUP funds a systematic, revenue-driven buyback-and-lock program rather than a per-purchase treasury vote. Jupiter
  • Hyperliquid Assistance Fund — not Solana, but the most-cited comparable buyback model in Solana-ecosystem commentary; spends fee revenue on HYPE buybacks continuously, no per-purchase vote.
  • Solana Foundation Delegation Program (SFDP) — a Foundation-run, not tokenholder-voted, mechanism enforcing validator behavior norms (§6) — Solana’s governance-adjacent enforcement runs through foundation policy and validator economics, not on-chain votes.

6. Risks, attacks, and incidents

Section titled “6. Risks, attacks, and incidents”
  • Real incident: the Beanstalk governance attack, 17 April 2022 (as of 2022-04). An attacker used a flash loan to “exploit the protocol’s governance mechanism,” gaining enough temporary voting power to pass a malicious proposal that redirected roughly $77 million in non-Beanstalk-user assets from the protocol’s liquidity pools, entirely within one transaction (Beanstalk, official blog). Root cause: voting power could be acquired and spent atomically with no time delay before it counted — exactly the flash-loan vote-buying risk Ehrsam’s framework flags as a known, “already worked” attack pattern (Ehrsam, 2020-10).
  • Real incident: Compound’s Proposal 62 COMP over-distribution bug, October 2021 (as of 2021-10). A governance-approved upgrade meant to change how COMP rewards split between suppliers and borrowers shipped with a bug letting some users over-claim COMP — estimates of tokens at risk range roughly $70–90 million across secondary reporting (The Block; Cointelegraph, secondary). Governance itself had to pass a follow-up proposal (64) to patch it, showing governance as both the source of the risk and the only available remedy once a change is live.
  • Vote-buying and bribe markets. Ehrsam treats “buying votes or voting with borrowed tokens” as a documented exploit class, not a hypothetical (2020-10); Curve’s bribe markets institutionalize a milder, priced version of the same dynamic — an open question is whether transparent bribery mitigates or merely legalizes it.
  • Governance capture through token concentration. Formalizing “who has a say and how much” is “very hard in practice at a single point in time and near impossible over time,” since future stakeholders are systematically underrepresented (Ehrsam, 2020-10).
  • Buyback programs move discretion outside governance entirely. Algorithmic, revenue-funded buybacks (Jupiter, Hyperliquid) sidestep the classic vote-capture surface, but also remove holders’ ability to redirect that revenue if circumstances change — trading vote-capture risk for inflexibility.

7. Open problems

Section titled “7. Open problems”
  • Where does value capture net out? Ehrsam frames “value capture = use × take rate,” arguing governance-minimized protocols win on use, but leaves open whether their take rate can sustain them relative to a traditional company (2020-10).
  • Can any voting system escape the underlying game theory? Ehrsam cites the inherent instability of all governance systems and Arrow’s impossibility theorem as a structural ceiling on how good on-chain governance can get, not an engineering problem to be solved (2020-10).
  • Is validator-stake-weighted governance more or less legitimate than tokenholder voting? Solana’s SIMD process ties change authority to validators rather than a governance token, leaving non-validator SOL holders with no direct vote on base-layer changes — a largely undebated question versus Ethereum’s litigated DAO model.
  • What replaces governance where DAICOs didn’t stick? DAICOs saw limited production adoption despite influencing later capped-spending designs; whether a better mechanical substitute exists remains open (multiple replies, ethresear.ch 465, 2018-01).

8. Ethereum vs Solana

Section titled “8. Ethereum vs Solana”
AspectEthereumSolana
Base-layer governanceDeliberately minimized; social consensus + hard forksValidator stake-weighted SIMD feature-gate votes
Application-layer governanceWidespread tokenholder DAOs (Compound, Uniswap, Curve)Less standardized; some app DAOs (Jupiter) exist
Vote-escrow / lock-based votingCurve’s veCRV and its imitatorsNot a dominant pattern in sources reviewed
Value-capture mechanismGovernance-voted fee switches (e.g. Uniswap, 2025-12)Algorithmic, revenue-funded buybacks (Jupiter Litterbox Trust)
Best-documented governance attackBeanstalk flash-loan governance attack (2022-04, ~$77M)None documented in sources at the base-layer governance level

Ethereum’s culture centers on the explicit tokenholder vote — with the vote-buying and flash-loan risk that implies — softened by vote-escrow locks that make voting power costly to acquire briefly. Solana pushes protocol authority toward validators who already have stake-based skin in the game, and pushes application-layer value-capture toward mechanical, revenue-triggered buybacks needing no per-decision vote — a structurally different answer to the same question of changing a widely-relied-on system without letting a temporary majority capture it.

9. Reference doc

Section titled “9. Reference doc”

The reference

Section titled “The reference”

Governance Minimization — Fred Ehrsam (Paradigm), 28 October 2020. paradigm.xyz/writing/governance-minimization

Summary of the reference

Section titled “Summary of the reference”

Ehrsam opens by noting that on-chain governance had, by 2020, gone from an obscure idea to a standard feature of major protocols — and argues the most widely used protocols will nonetheless trend toward governance minimization over time, drawing an explicit analogy to how HTTP and SMTP became universal standards precisely because no single company could unilaterally change them against users’ interests. He defines governance minimization as reducing reliance on governance wherever a mechanical rule can substitute, in service of credible neutrality — the property that lets a stakeholder build on or use a protocol with confidence it won’t later change against their interests. He illustrates the failure mode with Facebook’s platform API shutdowns and centralized-exchange exit scams as examples of what happens when credible neutrality is absent.

The post’s central argument is that formalizing governance is intrinsically harder than it looks, because formalizing stakeholders is nearly impossible to get right even at a single point in time, let alone as a protocol’s user base evolves. Token-holder voting in particular suffers systematic misalignment: token ownership doesn’t track true stakeholder importance, tokenholders’ time horizons are finite while protocols aim to be permanent, and tokenholders may hold outside economic interests (a large position in a different token) that bias their vote. He catalogs concrete exploits — vote-buying, and voting with borrowed tokens via flash loans, the latter explicitly “already worked” against a live DeFi protocol election by the time of writing — as evidence these aren’t hypothetical risks. He distinguishes “essential governance” (consensus itself, oracle validity — decisions that genuinely require human judgment and can’t be derived from on-chain data) from governance that is merely convenient today but could eventually be automated away (Maker’s interest-rate-setting is his running example of the latter).

The piece closes on a more measured note: governance minimization is not a panacea (a hard-forking majority can still act against a minority’s interests, though at real reputational cost), and well-functioning governance remains vital precisely in the areas of essential governance, where Ehrsam expresses optimism about future innovation beyond simple one-token-one-vote systems, citing quadratic voting and futarchy as examples of unexplored design space. He frames the ultimate outcome as an open economic question: “value capture = use × take rate,” where governance-minimized protocols should win on use, but whether they can sustain a viable take rate relative to a traditional company remains genuinely uncertain.

Key quotes

Section titled “Key quotes”

“Governance minimization means reducing the power and reliance on governance wherever possible.” (§ Governance Minimization)

“The more formal a governance system, the more susceptible it tends to be to capture over a sufficient time horizon.” (§ Governance minimization creates more neutral protocols)

“Exploits to act on these misalignments are well documented and hard to avoid. Prominent attacks include buying votes or voting with borrowed tokens — an attack made easier with the invention of flash loans that has already worked!” (§ Tokenholder misalignment)

“Governance is needed where a core mechanism of a protocol requires human input… We refer to these mechanisms as ‘essential governance.’” (§ When is governance valuable?)

How to read the original

Section titled “How to read the original”

Background needed: a basic sense of what an on-chain DAO vote is and what a flash loan is (a loan borrowed and repaid within one transaction — see /lending/flash-loans/). Skip the “Value Capture” section on a first pass if you’re focused on the governance mechanics rather than the business-model question; it’s a genuinely open question the author raises but does not resolve, and reads more as a closing speculation than a load-bearing argument. The hardest part to internalize is the essential/inessential governance distinction: it is tempting to read it as “governance is bad,” but Ehrsam’s actual claim is narrower — that any governance a protocol can remove without losing real functionality, it eventually will be pressured to remove by competition from more credibly neutral alternatives.

What changed since

Section titled “What changed since”
  • Ethereum’s own base layer has stayed governance-minimized in exactly the way Ehrsam predicted, while application-layer DAOs (Uniswap, Compound, Curve) proliferated and then, years later, began actually exercising previously dormant powers — Uniswap’s fee switch remained purely theoretical from 2020 until its December 2025 activation, a five-year gap between “the governance exists” and “the governance was actually used for its most consequential purpose.”
  • Vote-escrow (veCRV) and its bribe-market ecosystem (Votium, Convex) emerged after this post as a specific, widely copied answer to the tokenholder-misalignment problem Ehrsam describes, by making voting power costly and time-locked rather than instantly liquid.
  • Real governance attacks materialized as predicted: Beanstalk’s flash-loan governance attack (April 2022) and Compound’s Proposal 62 bug (October 2021), both discussed in §6, are concrete instances of the “already worked” vote-manipulation risk and the general fragility of governance-executed code changes that this post treats mostly in the abstract.
  • Solana’s SIMD process, which did not exist in this post’s frame of reference (Ethereum-centric DAO governance), represents a third governance model this post does not address: authority tied to validator stake rather than either “essential” protocol-level human judgment or a separate tokenholder vote.

Secondary references

Section titled “Secondary references”
  1. Vitalik Buterin, “Explanation of DAICOs” (ethresear.ch 465, 2018-01) — read for a concrete design applying governance-minimization thinking to fundraising specifically; discussed in §3–4 above.
  2. Curve documentation, “veCRV” (accessed 2026-08) — read for the production implementation of vote-escrow governance this page’s §3–4 math is based on.
  3. Beanstalk, official post on the April 2022 governance exploit — read for the clearest real-world case study of the flash-loan vote-buying risk this reference describes in the abstract.
  4. CoinDesk / CoinMarketCap coverage of Uniswap’s December 2025 fee-switch vote (secondary) — read for the most consequential recent instance of a long-dormant governance power actually being exercised.

10. Sources

Section titled “10. Sources”