Why Smart Contract Upgradability Dooms DAO Governance

A multi-sig upgrade key, even held by a DAO, is a single point of failure that can be socialized or exploited. The $325M Wormhole hack was patched via admin key, proving the backdoor exists for good and ill.\n- Concentrated Risk: Control over $10B+ TVL often rests with <10 entities.\n- Irreversible Actions: A malicious or coerced upgrade can drain a protocol instantly, beyond governance recall.

When core logic can change post-deployment, token voting becomes a suggestion box. Teams can and do override votes or implement un-audited changes, as seen in early Compound and Aave upgrades.\n- Plutocratic Inertia: <5% voter turnout is common, delegating real power to whales and core teams.\n- Speed vs. Security: Emergency upgrades bypass deliberation, creating a precedent for centralized crisis response.

Frameworks like EIP-2535 Diamonds enable modular upgrades without a monolithic proxy, allowing function-by-function replacement with explicit governance. MakerDAO's eventual migration to a Diamond proxy showcases this institutional shift.\n- Granular Control: Governance can vote on specific logic facets, not entire contract replacement.\n- Audit Trail: Every change is explicit and verifiable on-chain, reducing upgrade opacity.

The only viable model combines immutable core logic with strictly time-locked, executable-on-chain upgrade proposals. This mirrors Bitcoin's BIP process and is used by Uniswap v3.\n- Enforced Cooling Period: 7+ day delays prevent rash actions and allow for forks.\n- Full Verifiability: Every citizen can audit the pending code change before it goes live.

A multi-sig or DAO-controlled proxy admin key can unilaterally replace the logic of a $1B+ TVL protocol, nullifying all prior governance votes. This creates a silent hierarchy where the upgrade mechanism holds ultimate power, not token holders.

• Single Point of Failure: Compromise of the admin key means total protocol control.
• Governance Theater: Votes on proposals are advisory if the core can be swapped post-vote.
• Historical Precedent: Seen in early versions of Compound, Aave, and Uniswap.

Both protocols migrated to non-upgradable, immutable core contracts after recognizing the risk. This locked in the rules of the system, forcing future changes to occur via hard forks and liquidity migration—a costly but credible commitment.

• Credible Neutrality: Immutability forces the DAO to convince users to migrate, proving legitimacy.
• Eliminates Admin Risk: The protocol's behavior is permanently verifiable.
• High Coordination Cost: The Uniswap V3 fork demonstrates the extreme measure required for true change.

Maker's Emergency Shutdown Module (ESM) is a non-upgradable contract that allows MKR holders to permanently freeze the system. This is a one-way, immutable 'circuit breaker' that provides finality, contrasting with endlessly mutable proxy contracts.

• Immutable Finality: The ESM action cannot be reversed or upgraded away.
• Ultimate Accountability: Forces governance to bear the full consequence of its decisions.
• Contrasts Proxies: Highlights the safety of deliberate immutability over convenient mutability.

A 48-72 hour timelock on upgrades is often touted as a safety feature. In reality, it's merely a delay, not a veto. It provides an illusion of security while the upgrade path remains fully controlled by a privileged address.

• Execution, Not Approval: The timelock executes a pre-approved operation; it doesn't require new consensus.
• False Sense of Security: Users mistake the delay for a democratic checkpoint.
• Seen in: SushiSwap and countless other proxy-based DeFi protocols.

dYdX's migration to a Cosmos-based appchain removed the protocol from Ethereum's smart contract environment entirely. This shifted ultimate control to the validator set of the new chain, trading one form of centralized control (upgrade keys) for another (validator cartel).

• Jurisdictional Shift: Moves the control problem from contract admins to chain validators.
• High Barrier to Revert: Makes returning to a decentralized base layer nearly impossible.
• Highlights Trend: The 'appchain thesis' is often a search for a more favorable control structure.

The viable path is a non-upgradable core contract with functionality extended via modular, opt-in add-ons (e.g., new vaults, plugins). This mirrors the Ethereum model: the base layer is immutable, innovation happens at the edges.

• Core Guarantees: Settlement and core assets are permanently secure.
• Permissionless Extension: New features compete on their own merit without threatening the base.
• Adopted By: Uniswap V3 core, MakerDAO core contracts, Liquity.