← Duc V. Le
Preprint 2026

Concave is the New LinearSybil Attacks Collapse Anti-Plutocratic DAO Voting

Quadratic and other concave voting rules are meant to curb whales. On a permissionless chain, a whale can split tokens across many wallets. We show that the best split gives back voting power that is linear in the budget, whatever the fees.

Austin Bennett, Preston Vander Vos, Mira Belenkiy, Duc V. Le

Circle Research, USA

In three numbers · Table 2

What wallet splitting buys an attacker

We replayed the ten most recent finalized proposals of five major DAOs and asked how much capital an attacker needs to match all the honest voting power on each one.

Uniswap, quadratic voting
\$74.9K

Mean cost, tokens plus gas, to match every honest vote. The same control costs \$302.6M under linear voting.

QV amplification, 5 DAOs
1,172×–4,039×

How many times cheaper the attack is under QV than under one-token-one-vote, from ZKsync to Uniswap.

Power rule, $\beta = 0.25$
229,175×

Uniswap under the steeper power rule $f(w)=w^{0.25}$: control for a mean of \$1.3K.

The problem

A concave rule is only concave per wallet

Most DAOs give one vote per token, so whoever holds the most tokens at snapshot time wins. Quadratic Voting (QV) is the best-known fix: a wallet holding $w$ tokens gets $\sqrt{w}$ votes. A whale with 10,000 tokens gets only $100$ votes, so many small holders together can outvote them.

But a wallet is just a keypair, and anyone can make as many as they like. Split the same 10,000 tokens into 100 wallets of 100 tokens each, and every wallet casts $10$ votes: $1{,}000$ in total. In general, $n$ wallets give $n\sqrt{w/n} = \sqrt{nw}$ votes.

Chains are not free, so each extra wallet costs a transfer ($s$) and a vote transaction ($v$). The paper shows these fees don't save the rule. The attacker picks the wallet size $w^*$ that maximises votes per token spent, $f(w)/(w+c)$ with $c = v+s$, and fills as many such wallets as the budget allows. Total power becomes $\kappa\,(a-p)$, which is linear in the budget $a$.

Concavity discounts an attacker by a constant factor $\kappa$, but it gives no sublinear dampening at all. The honest voter who keeps one wallet still pays the concave discount; the attacker who splits does not.

Interactive · Lemma 9 and Theorem 10

The wallet splitter

Choose a budget and a voting rule. Each bar is the attacker's total vote count if the budget is split evenly across $n$ wallets, after paying $c$ per wallet. The best bar is the optimal split, and it sits right at the linear bound $\kappa a$ from Theorem 10.

Voting rule
Total votes as a function of the number of wallets
    Show the numbers as a table

    Model: Figure 3's Uniswap setup. Amounts are in USD. The per-wallet cost is $c = v + s$, where $v =$ is 175,000 gas for delegate + castVote and $s =$ is 65,000 gas for an ERC-20 transfer. Each is gas × gas price × ETH price, averaged over Uniswap's ten proposals in data/processed/. The setup cost $p$ and minimum balance $m$ are both $0$. The attacker's optimum is found by trying every whole number of wallets, as the paper's plotting script does. The single-wallet baseline is $f(a)$ with no fee, matching Table 1.

    Interactive · Lemma 8

    Why the attacker always splits evenly

    Take the paper's 10,000-token whale and four wallets. Drag a bar to move tokens between wallets; the total always stays 10,000. Under a concave rule, every uneven split loses votes. This is Jensen's inequality: the total $\sum_i f(w_i)$ can never beat $4\,f(10{,}000/4)$. Under the linear rule, how you split makes no difference.

    Voting rule
    Rebalance
    Four wallets holding 10,000 tokens in total; drag to rebalance

    Drag a bar, or focus it and use the ↑/↓ keys (250 tokens a step).

    An illustration of Lemma 8, with no fees. The 10,000-token whale with $\sqrt{10{,}000} = 100$ votes is the paper's own example from the introduction.

    Interactive · Figure 1 and Table 2

    What it costs to capture a real vote

    For each DAO, the grey bar is the mean capital needed to match all honest voting power under linear voting. Splitting doesn't help there. The coloured bar is the Sybil-optimal cost under the chosen concave rule, and each dot is one of the ten proposals. The scale is logarithmic: each gridline is a factor of ten.

    Concave rule
    Mean attack cost per DAO, linear voting versus the selected concave rule, log scale
      Show all 50 proposals as a table

      Source: data/processed/<dao>_summary.csv, column attacker_cost_usd. Each DAO's bar is the mean over its ten proposals, and the multiplier is the linear mean divided by the rule's mean, as in Table 2. All 20 cells of Table 2 reproduce exactly from these files.

      Interactive · Figure 2

      Same money, one wallet versus many

      Is it the splitting or just the money? Fix the budget at the Sybil-optimal QV cost from Table 2. The grid is all honest QV voting power on the DAO. Switch between holding that budget in one wallet and splitting it across Sybil wallets.

      DAO
      Budget held in
      Share of honest voting power captured by the attacker budget
        Show the numbers as a table
        Provenance note

        The paper gives the Uniswap single-wallet share as "$\approx 1/259$ ($0.38\%$)". The data gives $1/258.99 = 0.386\%$, which rounds to $0.39\%$. The page shows the value computed from the data. Each share is $\sqrt{a}/V_h$ for one proposal, averaged over ten proposals, as plot_qv_voting_power_scatter.py does. The multipliers match the ones printed on Figure 2: 259×, 140×, 190×, 359×, 240×.

        Interactive · Figure 3 and Figure 4 (Appendix B)

        Fees lower the plateau, they don't remove it

        Votes per dollar on Uniswap. An honest voter's votes per dollar (dashed) fall towards zero as the balance grows. The attacker's curves flatten at a constant $\kappa$. Raising gas or adding a minimum balance lowers $\kappa$ but leaves the attacker linear. Hover or drag across the chart to read values.

        Voting rule
        Voting power per dollar against amount voted, Uniswap
          Show the plateau values $\kappa$ as a table
          Provenance note: legend versus code

          Figure 3's caption and legend describe the frictions as "doubled gas ($2c$)" and "$m = 2$". The script that draws it, plot_attack_uni_vote_per_dollar_costs_kappa.py, actually uses a gas multiplier for both "$2c$" curves and $m = 4$ for the "$2c,\ m=2$" curve. This chart reproduces the curves the paper plots, labelled with the parameters actually used. The conclusion is the same either way: every curve still levels off at a positive $\kappa$.

          What the paper proves · Sections 3–5

          The results

          The model: an attacker with budget $a$ pays a one-time setup cost $p$, then $s$ to fund each wallet and $v$ for each vote. Each wallet must hold at least $m$. The quantity studied is the Sybil-adjusted voting power $V^*(a)$, the most votes any split can buy. A rule is plutocratic if $V^*(a) \ge \gamma\,a$ for large $a$.

          ResultStatementHolds for
          Lemma 5Cutting the budget into wallets of size $m$ gives $V^*(a) \ge \lfloor a/m \rfloor f(m)$.any rule with $f(m) > 0$
          Theorem 6Every nontrivial rule is plutocratic: $V^*(a) \ge \tfrac{f(m)}{2m}\,a$ for $a \ge 2m$.any nontrivial rule
          Theorem 7Adding costs $(m, v, p, s)$ keeps it plutocratic: $V^*_C(a) = \Omega(a)$.any linear cost scheme
          Lemma 8For a fixed number of wallets, an even split maximises $\sum_i f(w_i)$ (Jensen).concave $f$
          Lemma 9With $n$ wallets, the best balance per wallet is $w^* = \frac{a-p}{n} - (v+s)$.positive, concave, strictly increasing $f$
          Theorem 10$V^*(W) \le \kappa\,(a-p)$ with $\kappa = \sup_{x \ge m} \frac{f(x)}{x+c}$, and $V^*(W)/(a-p) \to \kappa$ when the supremum is attained.concave $f$, $c = v+s > 0$
          Corollary 11Closed forms for power, quadratic and logarithmic voting (Table 1, below).$m$ slack at the optimum

          Table 1 · Single wallet versus Sybil-optimal power

          $A = a - p$, $c = v + s$.

          Voting ruleOne wallet $V(W)$Sybil-optimal $V^*(W)$
          Linear$a$$a$
          Quadratic$\sqrt{a}$$\dfrac{a-p}{2\sqrt{v+s}}$
          Power, $\beta \in (0,1)$$a^{\beta}$$\dfrac{(a-p)\,\beta^{\beta}(1-\beta)^{1-\beta}}{(v+s)^{1-\beta}}$
          Logarithmic$\ln(a+1)$$\dfrac{(a-p)\,W_0\!\left(\frac{v+s-1}{e}\right)}{v+s-1}$

          What would help · Section 7

          Proof-of-Personhood

          Binding votes to people caps the number of wallets. It is necessary but not sufficient: it breaks the linearity result only if acquiring credentials costs more than capturing the vote is worth.

          Economic friction

          Bonds, longer snapshot look-backs and age-weighted voting raise $p$ and $s$. By Theorem 10, they only lower the slope $\kappa$. Superlinear fees would need wallets linked to people, which is the identity problem again.

          Composite governance

          A bicameral design (a concave chamber plus a linear one) or an identity quorum (at least $k$ verified people must vote yes) stops Sybil splitting from being enough by itself.

          Measured results · Section 6

          Table 2: mean attack cost, 50 proposals

          Mean capital in USD to match all participating honest voting power, over ten proposals per DAO. Parentheses give the Sybil amplification factor: how many times cheaper the attack is than under linear voting.

          Setup

          DataAddress-level votes from Tally for the ten most recent finalized proposals of ENS, Compound, Uniswap, Arbitrum and ZKsync, as of April 2026 (50 proposals).
          Ethereum L1ENS, Compound, Uniswap: $s$ = 65,000 gas (ERC-20 transfer), $v$ = 175,000 gas (delegate + castVote), at Etherscan gas prices on each proposal's creation date.
          L2 rollupsArbitrum, ZKsync: a conservative 500,000 gas for both splitting and voting, at historical L2 base fees.
          PricesCoinGecko spot prices on each proposal's creation date. The setup cost $p$ is set to $0$.
          MethodFor each proposal, sum the honest power $\sum_i f(w_i)$, solve $V^*(W) = \sum_i f(w_i)$ for the attacker budget $a$ using the closed forms, and convert to USD.
          CaveatHonest voters are assumed to keep their historical weights. A visible attack might bring out more defenders.

          Cite

          BibTeX

          @misc{bennett2026concave,
            title         = {Concave is the New Linear: Sybil Attacks Collapse
                             Anti-Plutocratic {DAO} Voting},
            author        = {Bennett, Austin and Vander Vos, Preston and
                             Belenkiy, Mira and Le, Duc V.},
            year          = {2026},
            eprint        = {2605.18990},
            archivePrefix = {arXiv}
          }

          arXiv v1 (2605.18990) was posted under an earlier subtitle, "The Impossibility of Anti-Plutocratic DAO Governance", with a different author order. The PDF linked above is the current version.

          Code and data: the paper has no code or data availability statement, so no repository is linked here.