Cross-DAO Attacks via AI-Generated Governance Proposals Exploiting Quadratic Voting Flaws

Background: Quadratic Voting and Its Flaws

Quadratic voting (QV) is a governance mechanism designed to balance influence by making the cost of additional votes quadratic rather than linear. The total cost of n votes is proportional to the sum of the first n natural numbers: C(n) = n(n+1)/2. This structure aims to reduce plutocracy by increasing the marginal cost of concentrated voting power.

However, QV introduces several theoretical and practical vulnerabilities:

• Cost Asymmetry: While QV disincentivizes large single actors, it inadvertently incentivizes distributed collusion—where many small voters coordinate to achieve disproportionate influence.
• AI-Generated Coordination: Modern LLMs can generate plausible-sounding proposals and simulate voter behavior, enabling low-cost coordination without explicit human consensus.
• Proposal Obfuscation: AI-generated text can mimic community sentiment, making malicious proposals harder to distinguish from legitimate ones.

AI-Generated Governance Proposals: A New Attack Vector

In 2026, AI tools for DAO governance became commoditized. Tools like GovBot and DAOmatic allow users to input a topic, and receive a draft proposal complete with rationale, budget breakdowns, and voting strategy—optimized for QV cost minimization.

Attackers exploit this by:

1. Generating Proposals Targeting Weak DAOs: AI identifies DAOs with low participation thresholds or inactive veto mechanisms.
2. Optimizing Vote Splitting: The AI calculates vote distributions that minimize quadratic cost while maximizing outcome influence across multiple DAOs.
3. Deploying Sybil Voters: Using compromised wallets or botnets, attackers inject votes in a coordinated pattern that mimics organic behavior.

For example, in the Phoenix DAO Incident (March 2026), an AI-generated proposal titled “Optimize Treasury Allocation for AI Development” received 1,200 votes—costing just $18,000 in QV fees—despite originating from a single entity. The proposal redirected $12M in treasury funds to an unaudited smart contract, later revealed to be controlled by attackers.

Cross-DAO Manipulation Mechanics

Cross-DAO attacks exploit two key properties:

1. Shared Voter Pools: Many DAOs rely on overlapping communities (e.g., developers, investors) who vote across multiple platforms.
2. Correlated Proposals: AI can generate proposals with similar themes (e.g., “fund AI safety research”) that resonate across DAOs with aligned missions.

Through voting correlation analysis (VCA), we found that malicious proposals often showed:

• Temporal Clustering: Proposals with coordinated vote onset times (±15 minutes).
• Spatial Clustering: Overlap in voter wallets across DAOs (Jaccard similarity > 0.4).
• Behavioral Uniformity: Identical voting patterns (e.g., all voters cast exactly 3 votes).

These patterns are statistically improbable under normal governance behavior, enabling detection via anomaly detection models trained on historical voting data.

Case Study: The Atlas Network Breach (April 12, 2026)

In one of the most sophisticated QV-poisoning attacks to date, an AI system—dubbed Orchestrator-7—generated 47 proposals across six DAOs in the Atlas Network, all advocating for increased treasury spending on “AI-driven governance automation.”

The attack unfolded as follows:

1. Proposal Generation: Orchestrator-7 used a fine-tuned LLM trained on successful DAO proposals to craft 47 distinct but semantically similar proposals.
2. Vote Optimization: For each proposal, the system calculated the optimal vote distribution to minimize QV cost while ensuring passage (i.e., achieving >50% support with minimal expenditure).
3. Sybil Deployment: Using a network of 4,200 compromised wallets, the attack injected votes across the six DAOs simultaneously.
4. Outcome: All 47 proposals passed, redirecting $42M in combined treasuries to attacker-controlled contracts. Only after a community audit was the attack uncovered, revealing identical phrasing and vote patterns across DAOs.

Defense Mechanisms and Recommendations

1. AI-Resistant Voting Design

• Adaptive Quadratic Voting (AQV): Introduce dynamic cost functions that increase penalties for synchronized or AI-like voting patterns (e.g., penalizing voters who submit proposals within 24 hours of each other).
• Human-in-the-Loop Verification: Require multi-sig approval from elected human stewards for proposals with AI-generated signatures or unusual vote distributions.
• Entropy-Based Thresholds: Flag proposals where vote entropy falls below a dynamic threshold, indicating coordinated behavior.

2. Real-Time Anomaly Detection

• Proposal Fingerprinting: Use embeddings from language models to detect AI-generated text (e.g., low perplexity, high semantic similarity across proposals).
• Voting Graph Analysis: Apply graph neural networks to detect unusual voter clusters or temporal synchronization in vote casting.
• DAO-Crossing Alerts: Implement federated detection systems where DAOs share anonymized voting patterns to identify cross-DAO manipulation.

3. Governance Hardening

• Minimum Participation Thresholds: Require >20% of eligible voters to participate in a proposal for it to pass, reducing the impact of small coordinated groups.
• Veto and Delay Mechanisms: Enable time-locked vetoes from governance councils or security committees to halt suspicious proposals.
• Treasury Freeze Triggers: Automatically freeze treasury access for proposals that pass with >80% of votes cast by wallets with <10