> For the complete documentation index, see [llms.txt](https://blockful.gitbook.io/anticapture/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blockful.gitbook.io/anticapture/anticapture/framework.md).

# Anticapture Framework

<figure><img src="/files/gRmJ0sAbPAnkqDlgcoqS" alt=""><figcaption></figcaption></figure>

## \[FRAMEWORK] The Anticapture Framework //

The Anticapture Framework evaluates DAO governance security by mapping common attack vectors and defining protective metrics. It translates complex risks into measurable indicators, enabling DAOs to anticipate vulnerabilities before they escalate.

\
By assigning risk levels (low, medium, high), it categorizes each DAO into stages of security maturity. This structured approach makes governance security visible, comparable, and actionable across the ecosystem.

{% hint style="warning" %}
These metrics were developed based on the study of more than 30 real-world governance attacks. While we act as an independent risk assessor, applying this framework does not guarantee that every DAO will adopt it or remain fully secure (though they should).
{% endhint %}

***

### Metrics we analyze

The Anticapture framework was designed with different types of attacks in mind.

From our knowledge base of past attacks on DAOs, we see what the most common attack vectors are – and check which metrics can help anticipate them.

{% columns %}
{% column width="50%" %}

1. Proposal Flash Loan Protection
2. Voting Flash Loan Protection
3. Timelock Delay
4. Voting Delay
5. Proposal Threshold
6. Veto Strategy
7. Proposer Voting Power Retention Check
8. Voting Period
   {% endcolumn %}

{% column width="50%" %}
9\. Vote Mutability
10\. Voting Subsidy
11\. Spam Resistance
12\. Audited Contracts
13\. Interface Hijack
14\. Extractable Treasury Value
15\. Security Council
16\. Timelock Admin
{% endcolumn %}
{% endcolumns %}

***

### Stages

Our stages are based on the highest risk point in the DAO.&#x20;

A DAO stage will always be equal to the worst metric they have. That means that any metric matching Stage 0 will make the DAO Stage 0, while to be Stage 1 the DAO can’t have any stage 0 metrics and has at least one that doesn’t match the criteria for Stage 2

{% tabs %}
{% tab title="🔴 Stage 0" %}

* Half of Active Power Supply and delegated supply ≤ DAO treasury assets – *except gov tokens*
* Half of delegated supply ≤ DAO treasury assets – *except gov tokens*
* There is no Proposal Flash Loan Protection
* There is no Voting Flash Loan Protection
* No timelock
* Voting Delay < 2 days
* Proposal Threshold < 0.5% market supply
* Veto Strategy managed by external entity
* There is no Proposal Threshold Cancel
* Voting Period ≤ 3 days
* No subsidy for voters/delegates
* There is no limit for submit proposals
* Governance contract were not audited
* DAO Domains and third parties don’t follow protection standards
* Half of Active Power Supply and delegated supply ≤ DAO treasury assets – except gov tokens
* Has a Security Council, but with insufficient security measures
* Governor controlled by entity outside of DAO/Foundation
  {% endtab %}

{% tab title="🟡 Stage 1" %}

* Timelock Delay is less than 1 day
* Voting Delay > 2 days
* Proposal Threshold ≥ 0.5% market supply
* Veto Strategy managed by Foundation/Labs
* Voting Period between 4 and 6 days
* Voter can't change their vote
* Audited, but not passed on the audit tests or the report isn’t public
* DAO domains fail to meet DNS protection standards
* Half of Active Power Supply ≤ DAO treasury assets – except gov tokens, but delegated supply > DAO treasury
* Has a Security Council, but use L2 Beat Legacy Standards
* Timelock controlled by the DAO, audited contracts, but a Foundation/OpCo
  {% endtab %}

{% tab title="🟢 Stage 2" %}

* Proposal Flash Loan Protection
* Voting Flash Loan Protection
* Timelock Delay > 1 day
* Voting Delay > 2 days + Protection Plan
* Proposal Threshold ≥ 1% market supply
* Veto Strategy managed by the DAO
* Proposal Threshold Cancel
* Voting Period ≥ 7 days
* Voter can change their vote
* Subsidy for "gas free" votes
* Proposal limit imposed by the DAO
* Contracts audited and a public report
* DAO Domains and third parties follow protection standards
* Half of Active Power Supply > DAO treasury assets – except gov tokens
* Has a Security Council and follow L2 Beat Standards
* Timelock controlled by the DAO and audited contracts
  {% endtab %}
  {% endtabs %}

The Anticapture Framework is still evolving to adapt to more types of organizational structure. See something that doesn’t make sense for your DAO? [Reach out](https://t.me/danimimm)!