The DAO

Summary

The DAO ("Decentralized Autonomous Organization") was a venture-capital fund encoded entirely in Ethereum smart contracts, conceived by the team at German startup Slock.it (Christoph Jentzsch, his brother Simon Jentzsch, and Stephan Tual). Its whitepaper was published in March 2016 and the crowdsale opened on 30 April 2016. Over a roughly four-week creation phase it raised approximately 11.5–12 million ETH — worth about $150 million at the time — from more than 11,000 participants, making it the largest crowdfunding event to that point. Token holders were meant to collectively vote on funding "proposals," directing capital to projects and sharing in returns.

On 17 June 2016 an attacker exploited a reentrancy vulnerability in the contract's split mechanism, draining roughly 3.6 million ETH (~$50M then) into a "child DAO." The crisis forced the Ethereum community to choose between honoring "code is law" and reversing the theft. On 20 July 2016, at block 1,920,000, Ethereum executed a hard fork that moved the funds to a withdrawal contract; the minority chain that rejected the fork became Ethereum Classic. The DAO is the canonical cautionary tale of onchain governance and smart-contract risk.

Design (Mechanism)

• Creation / crowdsale phase: Anyone could send ETH and receive DAO tokens at a fixed rate (100 DAO per ETH early, rising later), with tokens tradeable after the sale.
• Proposals and voting: Token holders voted on funding proposals submitted by "Contractors." Proposals had a debating period, a quorum requirement scaled to the amount requested, and yes/no voting weighted by token balance.
• Curators: A whitelist of trusted individuals (the "curators," a group of well-known Ethereum figures) controlled which proposal addresses were valid recipients — a human checkpoint against obvious fraud, but not a controller of funds.
• The Split function (minority protection): A dissenting holder could invoke splitDAO to create a "child DAO," moving their share of ETH out with like-minded holders rather than being outvoted — the "ragequit" precursor. This mechanism was central to both the design philosophy and the exploit.
• Reward mechanism: The contract tracked reward balances and paid them during splits.

The vulnerability lived in the interaction between splitDAO and the withdrawal/reward logic: the contract sent ETH to the caller before zeroing the caller's internal balance. A malicious contract's fallback function recursively re-entered the split/withdraw path, repeatedly extracting ETH against a balance that had not yet been decremented (reentrancy). The child-DAO created by the attack carried a mandatory ~27-day holding period before funds could be moved, which bought the community time to respond.

Outcome

Status: exploited. The DAO raised more capital than any prior crowdfund, then lost roughly a third of it to the June 2016 attack before funding a single meaningful proposal. The community response fractured Ethereum permanently: the 20 July 2016 hard fork moved the drained ETH into a recovery contract from which original contributors could withdraw ~1 ETH per 100 DAO, while Ethereum Classic (ETC) preserved the un-forked chain on which the theft stands. DAO tokens were delisted (Poloniex September 2016, Kraken December 2016) and the entity became defunct. The attacker's identity was never authoritatively established.

Why it worked

• Timing and narrative: It arrived when Ethereum enthusiasm was cresting and offered a concrete, ambitious use of programmable money — "a company with no CEO" — that captured imagination and capital.
• Genuine mechanism innovation: The split/child-DAO idea for minority exit was a real conceptual advance later echoed by Moloch DAO's ragequit and countless successors.
• Credible team and curators: Slock.it and the curator roster lent legitimacy that mobilized 11,000+ contributors.
• Open-source and public: Code, whitepaper, and proposals were public, which (ironically) also enabled the vulnerability to be studied — and exploited.

Where the design broke

• A single reentrancy bug — a class not yet widely understood in 2016 tooling — was enough to drain a third of the fund; audits and reviewers "did not know what to look for."
• Excessive complexity and scale too early: Jentzsch himself concluded such a large, complex contract was premature; more code meant more places for bugs.
• Governance was slow and abstract: Long debating periods, quorum problems, and voter apathy meant the DAO could not act decisively — and the very split feature meant for safety became the attack surface.
• Unresolved philosophy: The bailout hard fork violated "code is law," splitting the community and creating Ethereum Classic — a governance failure as consequential as the technical one.

Lessons

• Checks-effects-interactions is non-negotiable: Update internal state before external calls, and treat every external call as potentially reentrant. The DAO made reentrancy the archetypal Solidity bug and drove language/tooling guardrails (mutexes, .transfer gas stipends, later reentrancy guards).
• Complexity is the enemy of security: Minimize surface area; do not deploy record-breaking sums against unaudited-for-unknown-unknowns code. Ship gradually and keep escape hatches / upgrade paths early on.
• Social layer is the real backstop: No code is truly immutable when enough value and community will are at stake; "code is law" is a norm, not a guarantee, and its violation carries lasting cost (chain splits).
• Governance needs its own engineering: Voting quorums, apathy, plutocracy, and exit rights are hard problems that must be designed deliberately, not assumed.

Redesign (EDITORIAL — hypothesis, not fact)

The following is the researcher's editorial analysis, not established fact.

A modern re-implementation of The DAO would look almost unrecognizable, because a decade of tooling and pattern discovery now exists. At minimum: (1) the fund logic would use audited, battle-tested libraries (OpenZeppelin ReentrancyGuard, pull-over-push payments, checks-effects-interactions), with formal verification and multiple independent audits before any mainnet ETH is accepted. (2) Capital would be raised and released in tranches behind a timelock and a pausable circuit-breaker, so that a discovered exploit could be halted before a full drain — the 27-day child-DAO delay accidentally provided this once; a redesign would make it deliberate and shorter-loop. (3) Governance would likely separate treasury custody (a battle-tested multisig or a Gnosis Safe / governor + timelock stack) from token voting signaling, avoiding the situation where the exit mechanism itself is the attack vector. (4) Minority protection (the split idea) survives as Moloch-style ragequit, but implemented as a clean withdrawal against a share ledger rather than a recursive ETH-forwarding routine.

The harder, still-unsolved problems are social, not technical: how to make token-weighted governance resistant to apathy and plutocracy, and how to pre-commit credibly to an immutability policy so that a future "bailout fork" debate does not fracture the base chain. A candid redesign would probably concede that a fully autonomous, leaderless venture fund at $150M scale remains premature even now — and would launch small, permissioned, and progressively decentralizing, exactly the lesson Christoph Jentzsch drew in his own retrospective.

Note on X handles: The DAO itself was a leaderless onchain entity and had no verified official X account (Unknown/unverified). Founder handles (@chrjentzsch, @stephantual) and the company account @slockitproject belong to Slock.it and its people, are widely used and consistent with an official Ethereum Foundation tweet describing Slock.it, but could not be confirmed against a live official Slock.it website link at time of research, so they are marked strongly_inferred rather than verified.