Governance
Governance is the set of decision and execution rules that determines who can change protocol parameters, code, assets, fees, treasury use, or emergency state.
Category: GovernanceHexagon category cue
System record
Start with the economic purpose, participants, resources, and entitlements before studying implementation detail.
Why it exists
Programmable financial systems need a defined way to maintain rules, allocate authority, respond to incidents, and evolve without hiding who can alter user positions.
Traditional-finance analogy
Corporate governance and delegated administration is the closest comparison recorded for this concept.
Where the analogy stops
- Token voting, delegation, multisigs, timelocks, guardians, and immutable code can split formal voting from the actors who can actually execute a change.
- Permissionless capital and transferable voting power operate without automatically importing fiduciary duties, disclosure rules, or legal remedies from a corporation.
Main actors
- ActorToken holder, delegate, proposer, and voter
- ActorMultisignature signer, guardian, administrator, or council
- ActorTimelock proposer, canceller, and executor
- ActorUser whose assets or claims are governed
Assets and claims
Assets — controlled or transformed resources
Assets are resources the mechanism moves, holds, values, or transforms.
- AssetGovernance token or delegated voting power
- AssetProtocol-controlled reserves and treasury assets
Claims — entitlements and corresponding dependencies
Claims are rights to value, repayment, redemption, control, or another party's performance; each depends on an obligation or system that must honor it.
- ClaimProposal, vote, delegation, or execution right
- ClaimUser position subject to governed parameters, pauses, listings, fees, or upgrades
Governance is the complete path from proposing a change to executing it—not only the visible vote.
Why it exists
Section titled “Why it exists”Protocols need maintenance, parameter changes, listings, treasury decisions, upgrades, and incident response. Governance makes those decisions and powers explicit. An immutable system is also a governance choice because it constrains future intervention rather than eliminating control questions.
Traditional-finance analogy
Section titled “Traditional-finance analogy”Corporate governance and delegated administration are useful analogies. They stop where token voting, delegation, multisigs, timelocks, guardians, and contract roles split formal approval from execution. Transferable voting power does not automatically import fiduciary duties, disclosure, minority protection, or court remedies.
Actors, assets, and claims
Section titled “Actors, assets, and claims”Token holders or other members may delegate, propose, and vote. Signers, guardians, administrators, timelocks, and executors turn decisions into calls. Governed assets include reserves and treasury funds; governed claims include every user position whose fees, collateral rules, pause state, asset list, or implementation can change. Voting power is a control right, not a proportional claim on protocol assets unless another legal or contract rule says so.
Mechanism and flows
Section titled “Mechanism and flows”- Define who may propose and how voting or approval power is measured.
- Publish an exact action, rationale, and execution payload.
- Apply delay, voting period, quorum, counting, delegation, and cancellation rules.
- Queue an approved action in a timelock or other execution controller.
- Execute the exact payload after its conditions hold and monitor effects.
- Use separately bounded emergency powers when the ordinary lifecycle is too slow.
Control flow is primary. Capital flow follows treasury and parameter calls. Information flow carries proposals, votes, audits, and notices. Claim flow changes when governed rules alter user entitlements. Risk flow reaches users if formal voting, actual execution, or emergency authority is captured. Return flow is absent from governance itself; protocol fees, treasury assets, or token issuance pay delegates, contributors, and voters when compensation exists.
State and loss allocation
Section titled “State and loss allocation”| Proposal state | What may happen | Key protection |
|---|---|---|
| Draft or pending | Review and delegation | Exact payload and impact disclosure |
| Active | Votes or approvals accumulate | Snapshot, quorum, counting, and anti-replay rules |
| Succeeded and queued | Execution waits | Timelock and cancellation policy |
| Executed | Protocol state changes | Payload identity and post-change monitoring |
| Emergency | Narrow action may bypass normal delay | Explicit scope, expiry, and accountability |
If governance misprices risk, drains assets, upgrades malicious code, or blocks exits, governed users, LPs, lenders, borrowers, treasury holders, or an explicit backstop absorb the loss.
Beginner lens
Section titled “Beginner lens”Ask “who can change this?” for every protocol promise. A public vote does not prove that voters control every admin key or that approved text matches executed code.
Practitioner lens
Section titled “Practitioner lens”Map proposal thresholds, voting power, delegation, snapshots, quorum, counting, timelocks, cancellation, execution, guardian powers, upgrades, cross-chain governance, voter concentration, participation, communications, and exit windows.
Engineer or auditor lens
Section titled “Engineer or auditor lens”OpenZeppelin Governor and TimelockController are one modular implementation. Deployments choose voting-power sources, quorum, counting, delay, proposal identity, and execution roles. Review the concrete modules and role assignments; library documentation does not prove a deployed governance system is safe.
Security review notes
Section titled “Security review notes”Trace every effective control path. Bind votes and execution to the same proposal payload, snapshot, clock, and chain. Test quorum edges, delegation changes, signature replay, cancellation, queue and execute roles, timelock bypass, upgrade authority, guardian scope, and cross-chain messages.
Common misunderstandings
Section titled “Common misunderstandings”- “Token voting means decentralization.” Distribution, delegation, participation, execution keys, and emergency roles determine effective control.
- “A timelock prevents malicious governance.” It creates notice and exit time; authorized malicious actions can still execute.
- “Immutable means governance-free.” Immutability fixes some rules but leaves surrounding interfaces, assets, or social forks under other control.
Prerequisites and learn next
Section titled “Prerequisites and learn next”Read smart contracts and multisignature control. Continue to tokenomics and protocol treasury.
Sources
Section titled “Sources”- OpenZeppelin, How to set up on-chain governance — one on-chain governance architecture with proposal, voting, timelock, and execution stages (accessed 2026-08-09).
- The supplied DeFi seed, sections 4.5, 9.2, 10, and 12 — governance as a control and security system.
Machine-readable model
Key equations
Canonical expressions come from the structured concept record. KaTeX renders the notation, while the plain-text expression and variable table keep its meaning and units inspectable without JavaScript. Read the narrative above for the model's domain, assumptions, and rounding rules.
This concept does not require one canonical equation. Its mechanism and state transitions remain the authoritative explanation; do not invent a formula merely to make the topic look quantitative.
Assurance contract
Security properties
These structured statements define desired behavior. Their stable IDs can bind tests, invariants, specifications, audit findings, or proof results without turning descriptive review advice into an assurance claim.
Desired · not evaluated: No test, audit, or proof result is implied until scoped evidence is linked to this property.
Every effective control path identifies who can propose, approve, schedule, cancel, execute, pause, recover, and upgrade
Voting weight, snapshots, quorum, delegation, signatures, proposal identity, and payload execution follow the documented lifecycle
Delays and notices provide the promised review or exit window except under narrowly defined emergency authority
No hidden admin, signer, module, cross-chain executor, or role bypasses the disclosed governance constraints
Knowledge check
Quiz
Answer in your own words, then open the model answer.
Why must an audit trace beyond the vote?
Model answer
The actors and contracts that queue, cancel, execute, pause, or upgrade may have effective powers that formal voting does not constrain.