What is a DAO? Decentralized autonomous organizations explained, with their legal risks

The word “DAO” comes up whenever people talk about crypto governance: who decides how a protocol changes, who controls a shared treasury, who gets a vote. The idea is ambitious: an organization run by code and its members, without a boss. The reality has included one of the most famous hacks in crypto history and a court ruling that a DAO can be sued.

This guide explains what DAOs are, how they work and what regulators have said about them.

What a DAO is

ethereum.org defines a DAO as “a collectively-owned organization working towards a shared mission”. Instead of managers and a board, it relies on rules written in smart contracts on a blockchain, with no central leadership.

ethereum.org contrasts DAOs with traditional organizations:

What DAOs are used for

ethereum.org gives examples of what a DAO can do:

• A charity: accept donations from anyone in the world and let members vote on which causes to fund.
• Collective ownership: buy physical or digital assets together and vote on how to use them.
• Ventures and grants: pool capital, vote on which projects to back, and redistribute returns to members.
• Protocol governance: many decentralized finance protocols are steered by holders of a governance token who vote on changes.

The appeal, as ethereum.org puts it, is that you don’t need to trust the other members, only the DAO’s code, which anyone can inspect. The treasury is held by the smart contract, so no one can spend the money without the group’s approval.

How membership and voting work

ethereum.org describes three common models:

• Token-based: holding the DAO’s token gives you voting power. Tokens can usually be bought and sold freely.
• Share-based: shares represent voting power and ownership, and members can leave with their proportionate share of the treasury.
• Reputation-based: reputation is earned through participation and can’t be bought or transferred.

In token-based DAOs, more tokens usually means more votes. That makes it worth asking who holds most of them.

How decisions get made in practice

ethereum.org describes several governance models that sit on top of membership:

• Delegation: token holders delegate their votes to members who volunteer to stay informed and vote on their behalf, a kind of representative democracy.
• Automatic execution: a transaction runs automatically if a quorum of members votes in favor, sometimes with a founders’ veto.
• Multisig governance: even when thousands of people vote, the funds may sit in a multisig wallet controlled by a small group, often 5 to 20 trusted and publicly known members, who carry out the community’s decision.

That last model matters: if a small group of signers controls the treasury, members are trusting those people, not only the code. See multisig wallets explained.

The original: The DAO (2016)

The idea was tested at scale in 2016 by a project simply called The DAO. According to the SEC’s later report:

• From 30 April to 28 May 2016, The DAO sold about 1.15 billion DAO tokens for about 12 million ETH, worth about $150 million at the time.
• On 17 June 2016, before it could fund any projects, an attacker exploited a flaw in its code and diverted about 3.6 million ETH, roughly a third of what it had raised.
• The project’s founders and others then created a way for token holders to get their investment back.

Who was really in charge of The DAO?

The DAO was presented as decentralized, but the SEC’s report found important human control. Proposals had to be reviewed by The DAO’s “Curators”, a group of individuals chosen by the German company Slock.it, which had created The DAO. According to the report, the project’s own white paper said the Curators had “considerable power”: they decided which proposals could go to a vote, and they had ultimate discretion over whether a proposal was submitted at all.

That shaped the SEC’s conclusion. It found that investors expected profits from the managerial efforts of Slock.it, its co-founders and the Curators, whose efforts were essential to the enterprise. That’s a core part of the Howey test for an investment contract. See is crypto a security?

What US regulators have said

The SEC: The DAO’s tokens were securities

On 25 July 2017, the SEC published a report of investigation into The DAO. Based on the facts presented, it concluded that DAO tokens were securities under US federal securities law. It decided not to bring an enforcement action, but published the report to make clear that the federal securities laws can apply to offerings that use new technologies such as DAOs.

The lesson: calling something a DAO token doesn’t change how regulators look at what was actually offered and sold.

The CFTC: a DAO can be held liable

In a case brought by the Commodity Futures Trading Commission, a US federal court ruled on 9 June 2023 that the Ooki DAO was a “person” under the Commodity Exchange Act and could be held liable. The court found that it had unlawfully offered leveraged and margined retail commodity transactions, acted as an unregistered futures commission merchant and failed to meet Bank Secrecy Act obligations. It ordered:

• a civil penalty of $643,542,
• permanent trading and registration bans,
• the shutdown of the DAO’s website, including by third-party web hosts and domain registrars.

DAO laws in the US

Some US jurisdictions have created a legal status for DAOs. ethereum.org notes that Wyoming, which invented the limited liability company in 1977, pioneered a DAO law, and that Wyoming, Vermont and the Virgin Islands have DAO laws in some form. Its example: CityDAO used Wyoming’s DAO law to buy 40 acres of land near Yellowstone National Park.

A legal wrapper can clarify who is responsible for what and limit members’ liability, which the CFTC’s Ooki DAO case showed can be a real question.

The risks to weigh

• Smart contract risk: code can have bugs, as The DAO showed in 2016.
• Concentrated power: if a few wallets hold most tokens, “decentralized” decisions may be decided by a handful of people.
• Legal uncertainty: members’ legal responsibility and the DAO’s status can be unclear, and regulators have acted against DAOs.
• Governance attacks: anyone who gathers enough voting tokens may push through proposals, including ones that move treasury funds.
• Token price risk: governance tokens can be as volatile as any other crypto.

Before you join a DAO

1. Read its governance rules: who can propose, how votes are counted, how long voting lasts.
2. Check the token distribution: how much the founders and early insiders hold.
3. Look for audits of its smart contracts, and remember they’re not guarantees.
4. Understand the legal setup, if any, and what it means for you as a member.
5. Keep it separate: use a separate wallet for governance and new apps. See hot vs cold wallets.

For the wider ecosystem DAOs belong to, see what is DeFi? and what is Ethereum?