DeFi Governance: How Aave and Compound Run Billion-Dollar Protocols Through Token Voting

DeFi Governance: How Aave and Compound Run Billion-Dollar Protocols Through Token Voting

The two most established decentralised lending protocols in DeFi — Aave and Compound — govern themselves through mechanisms that would have been unrecognisable to conventional financial regulators as recently as 2019. There are no boards of directors, no executive management with override authority, no shareholder meetings conducted under company law. In their place: on-chain smart contract systems where holders of governance tokens propose, debate, and vote on changes to protocols that collectively hold billions of dollars in user deposits.

This governance model has produced real decisions with real consequences: the parameters that determine whether your borrowing position is liquidated, the assets accepted as collateral, the fee structures that route hundreds of millions in annual revenue, and the treasury grants that fund protocol development. It has also produced spectacular failures — attacks that exploited the governance mechanism itself to drain protocol treasuries — and persistent structural problems including voter turnout that would embarrass a small-town municipal election.

Understanding how DeFi governance actually works requires examining both the mechanics in detail and the honest record of what those mechanics have produced.

Compound: The Governor Bravo Model

Compound Finance, launched in 2018 by Robert Leshner and Geoffrey Hayes, was among the first DeFi protocols to implement genuine on-chain governance. The COMP token, launched in June 2020 through a liquidity mining program, initiated what would become the DeFi summer of 2020 — and COMP governance became the template for a generation of DeFi protocols.

COMP Token and Distribution

The COMP token entitles its holder to participate in Compound governance, with one COMP equal to one vote. The initial distribution allocated COMP through several channels: a portion to Compound Labs (the development company), a portion to investors, a portion to the founding team with vesting schedules, and — crucially — a portion distributed continuously to users of the Compound protocol proportional to their borrowing and supplying activity. This liquidity mining distribution was designed to progressively decentralise governance by placing tokens with actual protocol users.

The mechanics create a continuous governance decentralisation: the more the protocol is used, the more COMP flows to users, the more distributed governance becomes over time. In practice, this trajectory has been slower than idealists hoped, because early institutional investors and insiders received large allocations and because the liquidity mining mechanism was itself gamed — users borrowed and immediately re-supplied the same assets to maximise COMP accrual without providing genuine economic utility.

Governor Bravo: The Governance Architecture

Compound’s governance system, known as Governor Bravo (an upgrade from the original Governor Alpha), has become the most widely forked governance implementation in DeFi. It establishes:

• Proposal Threshold: A minimum COMP holding required to submit a governance proposal (originally 100,000 COMP, representing approximately 1% of total supply — subsequently lowered by governance itself).
• Voting Period: A fixed period (typically 3 days) during which COMP holders cast votes.
• Quorum Requirement: A minimum number of FOR votes required for a proposal to be valid regardless of outcome (400,000 COMP in the original implementation).
• Timelock: A mandatory delay (typically 48-72 hours) between a proposal’s passage and its execution, during which the community can identify and respond to malicious proposals before they are executed.
• On-Chain Execution: Passed proposals are automatically executed by the Governor contract calling the specified function on the specified contract — no human intermediary required.

Governor Bravo’s timelock mechanism is a critical security feature. Without it, a proposal that passed a governance vote would be immediately executable — including malicious proposals that drain treasuries or modify protocol parameters in harmful ways. The timelock gives the community a window to detect governance attacks and, through the guardian multisig, cancel malicious proposals before execution.

Real Governance Decisions: Compound

Compound’s governance record includes hundreds of executed proposals covering:

• Collateral factor adjustments: Lowering the collateral factor for LUNA (the Terra stablecoin’s associated token) from 65% to 0% in May 2022 as Terra’s collapse began — a rapid risk management decision executed through governance within days.
• Asset additions and removals: Adding new assets as supported collateral (LINK, WBTC, UNI) and removing deprecated assets. Each addition requires governance to assess oracle reliability, liquidity depth, and smart contract audit status.
• Reserve factor changes: Adjusting the percentage of interest payments that accrue to the Compound treasury rather than being distributed to suppliers — a parameter with direct impact on protocol revenue.
• cTOKEN market pauses: Pausing specific markets (the ability to borrow a specific asset) in response to oracle manipulation attempts or market stress events.

Aave: Layered Governance Architecture

Aave, the largest decentralised lending protocol by TVL as of early 2026, evolved from the ETHLend project into a multi-chain protocol governed by AAVE token holders. Aave’s governance architecture is more layered than Compound’s, reflecting both its larger scale and the experience gained from watching earlier governance implementations.

AAVE Token and stkAAVE

The AAVE token (upgraded from the original LEND token in a 100:1 migration in 2020) serves dual functions: governance (one AAVE equals one vote) and protocol safety. The Safety Module — a smart contract pool where AAVE holders stake their tokens as a backstop against shortfall events (unexpected protocol insolvency) — issues stkAAVE (staked AAVE) in exchange for staked AAVE. stkAAVE holders receive staking rewards (AAVE token emissions) and also participate in governance, but accept that their staked AAVE can be slashed (partially burned) to cover protocol losses.

This dual-use design aligns governance incentives: AAVE holders who vote on protocol risk parameters have “skin in the game” in the literal sense — if they vote for excessively risky parameters and the protocol suffers a shortfall, their staked AAVE may be slashed to cover the deficit.

Aave Governance v3 and the Voting Architecture

Aave Governance v3, implemented through governance vote in 2023, introduced a more sophisticated architecture:

• Snapshot Off-Chain Voting: Aave uses Snapshot (snapshot.org) for the critical off-chain temperature check and formal vote phases. Snapshot voting is gasless — voters sign a message with their wallet rather than submitting a blockchain transaction — dramatically increasing participation by eliminating the transaction cost barrier. However, Snapshot results are not self-executing: a trusted bridge or execution contract must implement the outcome.

• On-Chain Execution via Governance Contract: After a Snapshot vote passes, the execution is carried out by Aave’s on-chain governance contract through a cross-chain messaging protocol (Aave governance operates across multiple chains, and execution must be coordinated across Ethereum mainnet, Arbitrum, Optimism, Avalanche, and other chains where Aave is deployed).

• Guardian Multisig: Aave maintains a Guardian — a multisig wallet controlled by a set of trusted community members — that can execute emergency actions including pausing specific markets or cancelling malicious governance proposals during the timelock period. The Guardian is explicitly designed as a security backstop, not a governance actor. Its powers are limited and it is governed by multi-party control with community representation.

• Risk Parameters Governance: Among Aave governance’s most consequential ongoing activities is managing risk parameters: the loan-to-value (LTV) ratio for each supported collateral asset, the liquidation threshold, liquidation bonuses, borrow caps, and supply caps. These parameters directly determine the systemic risk profile of the protocol. Changes are proposed by the Aave Risk team (originally Gauntlet, a DeFi risk management firm) and voted on by AAVE holders.

Real Governance Decisions: Aave

Aave’s governance record illustrates the breadth and consequence of DeFi governance:

• Aave V3 Launch: The deployment of Aave V3 — a significant protocol upgrade introducing efficiency mode (eMode for correlated assets), isolation mode (limiting new assets to isolated markets), and cross-chain portals — was implemented through governance votes on each deployment chain. The V3 upgrade represented code changes worth hundreds of millions in TVL impact.

• USDC and DAI Supply Caps: After the March 2023 USDC depeg event (during the Silicon Valley Bank collapse), Aave governance voted on emergency supply cap reductions for USDC and DAI to limit the protocol’s exposure to stablecoin de-peg risk. These decisions were made and executed within hours — a governance process moving at the speed that financial risk required.

• GHO Stablecoin: Aave governance voted to create and launch GHO — Aave’s own native stablecoin — in 2023. This was a strategic expansion decision with multi-year implications for protocol revenue and architecture.

• Treasury Grants: The Aave Grants DAO, funded by AAVE governance votes, has distributed grants to dozens of ecosystem projects — developers, integrators, researchers — through a sub-DAO process overseen by an elected committee accountable to AAVE governance.

Governance Attack Vectors: When Token Voting Goes Wrong

DeFi governance’s attack surface is a fundamental design challenge that has produced some of the sector’s most dramatic failures.

Flash Loan Governance Attacks

A flash loan is a mechanism unique to DeFi: a user can borrow any amount of assets from a lending protocol, use them within a single transaction, and repay them by the transaction’s end — with no collateral required, because the loan and repayment occur atomically. Flash loans are legitimate tools for arbitrage, liquidation, and collateral swapping. They are also a theoretical vector for governance attacks.

The attack model: borrow a massive quantity of governance tokens via flash loan, use those tokens to vote on a malicious governance proposal in the same transaction, and profit from the outcome before the loan is repaid. This attack is possible only if governance voting can be done within the same transaction as token acquisition — a vulnerability that well-designed governance systems (including Compound and Aave) address by counting voting power based on token balances at a specified block number in the past (the “snapshot block”), not at the moment of voting. If voting power is snapshotted before the attack transaction, the flash loan tokens carry no voting power.

However, a variant of this attack is still possible over longer timeframes: an attacker can purchase governance tokens on the open market, hold them past the snapshot block, vote on a malicious proposal, and then sell them after execution. If the profit from the governance attack exceeds the cost of acquiring the tokens, the attack is economically rational.

The Beanstalk Hack: Governance Attack at Scale

The most consequential DeFi governance attack to date was the Beanstalk Farms exploit of April 2022, which resulted in the theft of approximately USD 182 million — at the time, one of the largest DeFi exploits in history.

Beanstalk was an algorithmic stablecoin protocol (BEAN) with an on-chain governance system. Beanstalk’s governance allowed the protocol’s own governance token, Stalk, to be used immediately after acquisition (without a timelock or snapshot delay) for voting. This created the exact flash loan attack vector that well-designed governance systems eliminate.

The attacker:

1. Took a flash loan of approximately $1 billion in stablecoins from Aave and other protocols
2. Used the stablecoins to buy enough Stalk and Seed tokens from Beanstalk’s liquidity pools to achieve a supermajority of voting power
3. Voted on two malicious governance proposals — one donating $250,000 to Ukraine (a distraction to achieve charitable appearance) and one transferring all protocol collateral to the attacker’s address
4. The governance system’s instant execution (no timelock) allowed immediate execution
5. The attacker repaid the flash loans, retaining approximately $80 million in profit after loan fees

The Beanstalk attack was not a smart contract exploit in the traditional sense — it exploited the governance mechanism exactly as designed. It was governance working correctly, applied maliciously. The protocol was eventually relaunched with substantially modified governance, but the lost funds were not recovered.

Both Compound and Aave had governance designs that explicitly prevented this attack — the snapshot block mechanism for Compound and Aave’s Snapshot-plus-timelock architecture — but Beanstalk’s implementation lacked these safeguards.

The Voter Apathy Problem

Among DeFi governance’s persistent structural challenges, voter apathy is arguably the most significant and least technically tractable.

Measured participation in major DeFi governance votes — the proportion of circulating governance tokens that actually votes — is consistently low. For Compound and Aave, typical participation in governance votes ranges from 5% to 15% of circulating supply. High-stakes votes (contested treasury allocations, major protocol upgrades) occasionally reach 20-25%. Routine risk parameter updates may see 3-5%.

The consequences are significant:

Effective Plutocracy: When 10% of tokens participate, effective governance control belongs to whoever holds the largest among that 10%. In practice, venture capital funds, protocol foundations, and large token aggregators (including market makers and protocol treasuries on other protocols) hold enough tokens that they can determine the outcome of most governance votes among the small fraction of tokens that participate.

Quorum Failure: Governance proposals can fail not because they are bad but because sufficient tokens did not participate to meet quorum requirements. This can create governance gridlock on routine maintenance decisions, forcing emergency pathways or multisig action.

Rational Abstention: From an individual token holder’s perspective, the cost of informed governance participation (research, gas costs for on-chain voting, time) often exceeds the expected benefit from any single vote — particularly for holders of small token positions. This classic collective action problem is solved partially by Snapshot’s gasless voting but not entirely.

Delegation: Liquid Democracy in DeFi

Both Compound and Aave support delegation: the ability for token holders to delegate their voting power to another address without transferring token ownership. Delegation enables holders who are unable or unwilling to participate directly in governance to assign their votes to representatives they trust to vote well.

Aave and Compound have both developed delegate programs — curated lists of individuals and organisations who have made public governance commitments and accept delegated voting power. Academic institutions (University of Michigan’s Blockchain Club), DeFi research firms (Gauntlet, Llama), and prominent individual contributors serve as delegates with substantial delegated voting power.

The delegation model creates something closer to a representative democracy than a direct democracy: most token holders do not vote directly, but their delegated votes are cast by representatives who specialise in governance. This partially addresses the voter apathy problem, at the cost of concentrating effective governance power in a smaller set of sophisticated actors.

The Compound and Aave governance systems have also seen experimentation with “governance minimisation” — the philosophy that a mature DeFi protocol should aspire to need as little governance as possible, removing controllable parameters and making the protocol immutable where safety permits. A protocol that cannot be changed by governance is also a protocol that cannot be changed by a governance attack.

Swiss Legal Structures and DeFi Governance

Neither Compound nor Aave operates through a formal Swiss legal entity for its on-chain governance — the governance processes themselves are conducted through smart contracts without a legal wrapper. However, both protocols interact with Swiss legal infrastructure through their associated foundations and service organisations.

Aave has explored the Aave Foundation structure for managing off-chain activities (grant programs, ecosystem development, regulatory engagement) that the on-chain governance mechanism cannot perform. A foundation approach — potentially including a Swiss Stiftung structure — addresses the operational need for legal personality, contracting capacity, and regulated financial activities that on-chain governance alone cannot fulfil.

The broader DeFi governance ecosystem’s interaction with Swiss law is shaped by the same dynamics as other DAO structures: on-chain governance provides the legitimate decision-making mechanism, while legal entities provide the interface with the off-chain world. Switzerland’s Stiftung law, FINMA’s engagement with DeFi protocols, and Zug’s specialist legal infrastructure remain relevant to how major DeFi protocols manage this off-chain/on-chain boundary — regardless of where the on-chain governance contract is deployed.

Frequently Asked Questions

What is the difference between AAVE and COMP governance tokens?

Both AAVE and COMP grant voting rights in their respective protocols’ on-chain governance systems, weighted proportionally to the number of tokens held. The key differences are in staking mechanics: AAVE can be staked in Aave’s Safety Module (earning yield while providing protocol backstop collateral), while COMP governance operates without a native staking safety module. Aave Governance v3 uses a hybrid Snapshot (off-chain, gasless) plus on-chain execution model; Compound’s Governor Bravo uses fully on-chain voting with gas costs per vote.

Can DeFi governance tokens be used for flash loan attacks?

Well-designed governance systems prevent flash loan governance attacks by snapshotting voting power at a past block, not at the moment of voting. Compound and Aave both use snapshot mechanisms that make flash-loan-acquired tokens ineligible to vote. The Beanstalk hack (April 2022, $182M loss) succeeded because Beanstalk’s governance used tokens’ current balances rather than a historical snapshot, allowing an attacker to acquire voting supermajority through a flash loan within a single transaction.

What is typical voter turnout in DeFi governance?

Participation in major DeFi governance votes typically ranges from 5% to 15% of circulating token supply for Compound and Aave. High-stakes or contested proposals occasionally reach 20-25%. Routine parameter updates may see 3-5% participation. Low turnout concentrates effective governance power among the minority of large token holders who consistently participate, and creates quorum failure risks for proposals that lack controversy but also lack attention.

How does governance delegation work in Aave and Compound?

Token holders can delegate their voting power to another address without transferring token ownership. Delegates vote on behalf of their delegators, effectively creating a representative democracy layer. Both protocols maintain public delegate programs listing individuals and organisations that have accepted delegated power and made governance commitments. Major delegates include university blockchain clubs, DeFi risk management firms, and prominent individual contributors. Delegation addresses the voter apathy problem partially, at the cost of concentrating governance influence in a smaller group.

What decisions has DeFi governance actually made?

Real DeFi governance decisions include: launching new protocol versions (Aave V3), adjusting collateral risk parameters (lowering LUNA collateral factor during Terra’s collapse), creating new financial products (Aave’s GHO stablecoin), distributing treasury grants to ecosystem developers, pausing specific asset markets in response to oracle manipulation, modifying interest rate models, and adjusting reserve factor percentages. These decisions affect billions in user deposits and represent genuine financial governance exercised by token holders.

Related Coverage

• DAOs in Switzerland: Legal Structures, Swiss Verein, and Crypto Valley’s DAO Ecosystem
• Ethereum: The Web3 Foundation and Zug’s Protocol Anchor
• Web3 Regulation in Switzerland: FINMA, the DLT Act, and MiCA Interaction
• DAO (Decentralised Autonomous Organisation): Definition and Types
• Ethereum Layer 2 Networks: Arbitrum, Optimism, and zkSync’s Swiss Connections

Author: Donovan Vanderbilt | The Vanderbilt Portfolio AG, Zurich Published: 25 February 2026