The problem one-token-one-vote can't fix
In the last guide you watched a flash-loan borrower seize a treasury in a single block. But there is a quieter failure that needs no exploit at all. Picture a DAO with a $40M treasury and 10,000 token holders. One fund holds 22% of the supply. When a proposal comes up to redirect grants toward that fund's own portfolio companies, it doesn't need to bribe anyone or break anything — it just votes its bag, a few aligned wallets join in, token-weighted voting does the arithmetic, and the proposal passes over the objections of 9,500 smaller holders. Nothing was hacked. The system worked exactly as designed. That is the design: one governance token, one vote means one dollar, one vote, and whoever has the most dollars decides.
This is plutocracy — rule by wealth — and it is the honest default of every token-weighted system. The branch of economics that studies how to design rules so that self-interested participants produce a good collective outcome is called mechanism design. The goal of this guide is to take that lens to governance: if one-token-one-vote over-weights wealth and under-weights how much people actually care, can we build a ballot that aggregates preferences more honestly? Three families of answers have been tried on-chain — quadratic voting, conviction voting, and futarchy. Each fixes something real. Each breaks something else. By the end you should be able to say not just how they work, but exactly which problem each one is buying and what it pays for it.
Quadratic voting: paying the square of your conviction
Quadratic voting (QV), formalized by Steven Lalley and Glen Weyl, starts from a simple complaint: one-token-one-vote lets you express which side you're on but not how strongly, while one-dollar-one-vote lets the rich express strength for free. QV makes strength cost. You get a budget of voice credits, and the price of casting v votes on an issue is v squared. The first vote costs 1 credit; the second costs 3 more (4 total); the tenth vote costs 19 more. The marginal cost of every extra vote rises linearly, so piling on gets quadratically expensive.
cost(v) = v * v # credits to cast v votes on one issue marginal(v) = v*v - (v-1)*(v-1) = 2v - 1 # price of the v-th vote votes(credits) = floor(sqrt(credits)) # votes you can afford # A member with a 100-credit budget: # all-in on issue X: 100 credits -> sqrt(100) = 10 votes # split 36 / 64: 6 votes on X, 8 votes on Y # Going from 9 -> 10 votes on X costs 19 credits; the 1st vote cost 1. # You CAN express intensity, but you pay quadratically to shout.
The deep property is that influence scales as the square root of resources: to buy 10× the votes you need 100× the credits. Lalley and Weyl proved that, in a large electorate with independent private values, this rule is approximately efficient — it tends to pick the option that maximizes total welfare, because each voter buys votes up to the point where their marginal cost equals their true intensity. A passionate minority can outvote an indifferent majority when, and only when, it genuinely cares more. That is something neither one-token-one-vote nor simple majority can do.
Quadratic funding: the Gitcoin matching machine
The most successful real deployment of quadratic ideas isn't a vote at all — it's quadratic funding (QF), the mechanism behind Gitcoin Grants. Buterin, Hitzig, and Weyl showed how to allocate a shared matching pool to public goods so that funding tracks breadth of support, not size of cheques. A project receiving contributions c₁ … cₙ from n distinct donors gets total funding equal to the square of the sum of the square roots of the contributions. The difference between that and the raw donations is paid out of the matching pool.
# Quadratic funding (idealized, unbounded matching pool) F = (sum of sqrt(c_i))^2 # total a project ends up with match = F - sum(c_i) # subsidy from the pool # Two projects each raise $100 directly: # A: 1 donor x $100 -> sqrt: 10 -> F = 10^2 = $100 -> match $0 # B: 100 donors x $1 -> sqrt: 100 x 1 = 100 -> F = 100^2 = $10,000 -> match $9,900 # # Same $100 of real demand, wildly different matching: # QF rewards the NUMBER of people who care, not the depth of one wallet.
Run the numbers and the philosophy jumps out: both projects raised the same $100 directly, but the one backed by a hundred separate people receives $9,900 in matching while the whale-backed one receives nothing. QF approximates the ideal of funding a public good in proportion to how many people benefit from it. Gitcoin has routed tens of millions of dollars to open-source software and public goods this way across dozens of rounds — a rare case of a fancy mechanism surviving contact with real users.
The sybil problem: why quadratic anything needs proof of personhood
Quadratic mechanisms all rest on one assumption: that each person gets one budget. Break that, and the square root that was supposed to dampen concentration becomes the very lever an attacker pulls. A sybil attack — named for a famous case of multiple personality — is one entity creating many fake identities. Watch what it does to QV over a divisible token.
# A whale holds 10,000 tokens. QV gives votes = sqrt(tokens). # # Honest, one wallet: sqrt(10000) = 100 votes # Split into k wallets: each sqrt(10000/k); # total = k * sqrt(10000/k) = sqrt(k) * sqrt(10000) = 100 * sqrt(k) # # k = 1 -> 100 votes # k = 100 -> 100 * 10 = 1,000 votes (10x more power, same money) # k = 10000-> 100 * 100 = 10,000 votes (back to LINEAR in wealth!) # # Splitting fully defeats the sqrt dampening. QV over money is a TRAP # unless you can prove one-budget-per-human.
The arithmetic is merciless. As the attacker splits into more and more wallets, total voting power climbs back toward being linear in wealth — the exact plutocracy QV promised to cure. The same is true of QF: a single sponsor can pose as a hundred small donors and harvest the matching pool meant for grassroots projects. So a quadratic mechanism is only as good as its sybil resistance. That is why every serious QF round bolts on identity: proof-of-personhood systems (Worldcoin's iris scan, BrightID's social graph, Gitcoin Passport's stamp aggregation) try to certify one human, one budget without a central registry. Gitcoin further layers on connection-oriented cluster matching, which mathematically discounts the matching weight of donor groups that suspiciously co-fund the same projects, blunting collusion even among real accounts.
Conviction voting: letting support build over time
The quadratic family attacks the wealth axis. Conviction voting, pioneered by the Commons Stack and 1Hive and shipped in Aragon, attacks the time axis instead. There is no fixed voting window and no snapshot. Instead, when you stake tokens behind a proposal, your support accrues conviction the longer you leave it there, decaying continuously toward a ceiling. A proposal passes the moment its accumulated conviction crosses a threshold that scales with how big an ask it makes of the treasury.
# Conviction accrues each block/period with a decay factor a in (0,1): conviction[t] = a * conviction[t-1] + staked[t] # Hold a constant stake s forever and conviction tends to a steady state: conviction_max = s / (1 - a) # Example, a = 0.9 -> steady-state multiplier = 1/(1-0.9) = 10x # stake 100 tokens continuously: # t1: 0.9*0 + 100 = 100 # t2: 0.9*100 + 100 = 190 # t3: 0.9*190 + 100 = 271 ... -> approaches 1000 over many periods # # A flash loan held for ONE block contributes ~100, not 1000. # Fleeting capital buys fleeting conviction.
Two things fall out of this design. First, it expresses durable preference: a proposal a few whales spike for one block barely registers, while one that a steady coalition holds for days builds unstoppable conviction. Second, it is structurally resistant to the flash-loan attack from the previous guide — borrowed capital held for a single block contributes almost nothing, because conviction needs time, and time is the one thing a flash loan cannot rent. The costs are honest, too: conviction voting is slow, its decay and threshold parameters are fiddly to tune, and it is still ultimately token-weighted, so it dampens whales' speed but not their size. It trades responsiveness for resilience.
Futarchy: vote on values, bet on beliefs
The boldest idea breaks governance into two questions. Economist Robin Hanson's futarchy observes that voting conflates two very different things — what we want (values) and what will achieve it (predictions) — and that markets are usually better than ballots at the second. So: vote to choose a measurable success metric, then let prediction markets decide which policy best moves it.
- Agree on a metric by voting. Token holders choose a welfare measure the protocol should maximize — say, the 30-day time-weighted average price of the token, or monthly protocol revenue. This is the 'values' step, and it stays democratic.
- Open two conditional markets per decision. For 'adopt policy A or not', create market 1 that pays out on the metric if A is adopted and market 2 that pays out on the metric if A is rejected. Each is a bet on the world conditional on a choice.
- Let the prices decide. If market 1 prices the metric higher than market 2, traders collectively believe A produces a better outcome — so adopt A. The losing market's trades are unwound and refunded. Speculators with money at risk do the forecasting.
It is a beautiful application of mechanism design: it puts forecasting in the hands of whoever is most confident enough to back their view with capital, rather than whoever holds the most tokens. But be honest — futarchy is almost entirely experimental. The metric is a Goodhart's-law landmine (optimize token price and you may invite pumps over substance); thin markets are cheap to manipulate, and manipulating the decision market can be worth far more than the bet costs; and tying real governance to gambling-shaped instruments raises legal and ethical problems. MakerDAO and others have flirted with it, prediction-market infrastructure like Augur and Polymarket exists, but no major protocol runs on pure futarchy. File it as a provocative idea, not a battle-tested tool.
Choosing a ballot: there is no perfect one
Step back and the pattern is clear: every mechanism buys one fix and pays with a new weakness. Quadratic voting and funding curb wealth concentration but export their security to a fragile identity layer. Conviction voting neutralizes flash mobs and flash loans but is slow and still size-weighted. Futarchy outsources forecasting to markets but needs deep, honest markets and a metric you can't game. This isn't bad luck — it's mathematics. Arrow's impossibility theorem says no ranked voting rule can satisfy a handful of reasonable fairness axioms at once, and Gibbard–Satterthwaite says any non-trivial deterministic rule is either dictatorial or manipulable. There is no ballot that is fair, strategy-proof, and expressive all at once. Mechanism design is the art of choosing which compromise.
That is why, in production, the cutting edge mostly stays boring. Most live DAOs still run token-weighted voting hardened with defense-in-depth: delegation so passive holders lend weight to engaged stewards, off-chain snapshot voting to gather sentiment cheaply before committing gas, timelocks so a contested outcome can still be exited or vetoed, and quorum thresholds to stop a sleepy minority from acting for everyone. The fancier mechanisms appear where their assumptions actually hold — quadratic funding for grant rounds (bounded budgets, identity gating), conviction voting for continuous treasury allocation in smaller, higher-trust communities. The right question is never 'which mechanism is best?' but 'best for what decision, under whose threat model?'