Sigvex
Simulation2 min read

Governance Risk

Measure how concentrated a token's voting power really is — pull holders and signers on-chain, read the concentration profile, and simulate what a compromised admin could do.

Open Governance & Economic ConcentrationAll guides
governanceconcentrationrisk

Governance Risk turns a token address into a concentration report. It gathers who holds the token and who signs for the multisig, reads out how concentrated the voting power is, and lets you simulate what a compromised admin key could actually do — an exportable artifact you can attach to a finding.

Why it exists

Concentrated voting power is a quiet risk in a lot of DAO tokens: a handful of wallets, or a low multisig threshold, can decide any vote or push any upgrade. This page makes that concrete — it quantifies the concentration, flags where a small set of holders crosses quorum, and models the damage if one of those authorities is compromised.

Who uses it

  • Auditor — documents governance concentration as part of an engagement.
  • Researcher — compares concentration across protocols.

How to open it

  1. Sidebar → Simulation → Governance Risk.
  2. Direct URL — /governance-risk.

Building a report

Start from the chain: pick the governance token (and optionally a governor contract), find top holders to discover holder wallets from transfer history, then fetch on-chain balances to fill the total supply, the top-holders table, and — for a compatible multisig governor — the signer list. Set the quorum threshold, token price, and flash-loan pool depth, and edit the holder and signer tables by hand where you need to.

The concentration report then gives a verdict plus the numbers that matter: top-5 and top-10 share, a Gini coefficient, how many holders it takes to reach quorum, the cost to capture quorum with a flash loan, and any deployer-cluster overlap in the multisig. From there, simulate compromise picks a role and a capability (withdraw, upgrade, transfer ownership, mint, pause, or destroy) and a value at risk, runs a fork simulation, and seals a capsule you can open in the Exploit Lab. Export JSON, Export CSV, or copy the report to attach it to your findings.

Limits

  • Requires a signed-in account.
  • On-chain fetch depends on token support and RPC availability — when it can’t resolve, fill the holder table manually.
  • The multisig section is optional and only appears in the report when you add signer rows.