Security
Emergency governance actions that do not become backdoors
Every protocol eventually needs to move in minutes. The question is whether the fast path is scoped or unlimited.
Scope the powers narrowly
Pausing a market is a reasonable emergency power. Moving treasury funds is not. Enumerate exactly which calls the fast path can make.
Raise the bar, not lower it
Shortening the timelock should come with a higher signature requirement, not a lower one.
Disclose within a fixed window
Publish what was done, why, and by whom within 24 hours, followed by a ratification vote.
Design the emergency path while calm
Emergency powers should be narrow, fast and loud: a small set of actions such as pausing a market, executable in minutes, and automatically publicised the moment they are used. Broad powers that are quiet are indistinguishable from an admin key.
Name the trigger conditions in advance. An oracle deviating beyond a stated band, an unexpected outflow above a threshold, or a disclosed vulnerability are concrete tests. Discretion without conditions invites both hesitation and abuse.
Ratification is what keeps it legitimate
Every emergency action should expire unless a normal vote ratifies it within a fixed window. That single rule turns a guardian from an unelected authority into a temporary circuit breaker.
Publish a post incident record with the timeline, the transactions, the reasoning and what changes as a result. Communities forgive fast intervention far more readily than they forgive silence afterwards.
Keep the execution path connected: this guide pairs well with dao governance metrics, dao compliance reporting and dao software, which cover the neighbouring steps between an approved vote and a settled onchain transaction.
Key concepts explained
New to this topic? These are the core terms you will meet again and again in governance work. Understanding them makes every proposal easier to read.
- Emergency action
- A fast-track governance move - pause a contract, freeze a market, rotate a compromised key - used when waiting for a normal vote would cause loss.
- Security council
- A small, publicly known multisig with narrow emergency powers. Its actions should be time-boxed and ratified by full governance afterwards.
- Pause switch
- A contract function that halts sensitive operations. Pausing is reversible and buys time; upgrading under fire is not.
- Post-mortem
- The written record of what happened, what governance did, and what changes. It converts an emergency into permanent institutional knowledge.
Frequently asked questions
- What is an emergency governance action?
- It is a pre authorised intervention such as pausing a contract that can be taken faster than a normal vote allows, in order to limit damage during an active incident.
- Who can trigger emergency governance?
- Typically a guardian multisig or security council whose members and powers were approved by an earlier governance vote.
- Does an emergency action need a vote afterwards?
- It should. Best practice is that the action lapses automatically unless token holders ratify it within a defined period.