Governance attacks drain treasuries through the voting mechanism itself — no code exploit, so no audit catches them. DAO-WARDEN watches, judges narrative against real calldata, and acts across two independent defense layers. Every claim below is proven on-chain.
An attacker holding 5% of supply clears the 1% quorum alone and proposes to withdraw the entire 1,000,000 mUSD treasury to itself. What changes between columns is only who is defending.
Why two layers. The vote defends during voting and needs delegated power. The timelock defends after a won vote — it saves the case even when the attacker holds a real majority. The timelock buys time; the guardian uses it. Together they cover both.
Reference case: the July 2026 BONK DAO attack. A few million dollars of tokens, extremely low turnout, a self-voted proposal — and a drained treasury. No contract was hacked. We reproduce this vulnerability class on EVM as a proving ground.
The core is deterministic and auditable, built before the AI layer and running without it. Claude Haiku adds one thing rules can't: judging whether the human-facing narrative honestly matches the calldata. Here is the agent's real readout of the WGIP-1 attack.
Watches the Governor for every new proposal, live.
→Recognizes Treasury.withdraw by selector 0xd9caed12.
→Evaluated at the proposal's creation block, not after.
→Core ≥ 45 or LLM major mismatch triggers a reaction.
Honest holders delegate their vote to the always-on guardian. Above the risk threshold it casts NO with that delegated power. In the live run: For 50k versus Against 100k → the proposal is defeated and the treasury is untouched.
acts DURING the voting periodThe mitigated DAO routes execution through a TimelockController — exactly one variable changed, quorum and threshold left deliberately weak. Holding CANCELLER_ROLE, the agent cancels the queued drain during the minDelay window. Even after a won vote: state Canceled, execute rejected.
acts AFTER the vote succeedsThe agent registered itself as an ERC-721 identity with an AgentCard on IPFS. Every decision is committed on-chain and independently scored — so a delegate you entrust with real voting power is itself auditable.
For each evaluated proposal the agent files a validationRequest whose requestHash is the keccak256 of the canonical decision record. Verified to the byte: the stored record's hash equals the on-chain hash, and its CID equals the on-chain requestURI. A decision cannot be silently changed later.
A separate validator wallet answers with a 0–100 score aggregated into the agent's reputation. On the real WGIP-1 defense the validator confirmed the decision 100/100 → reputation: 1 review, average 100.