Quadratic and other concave voting rules are meant to curb whales. On a permissionless chain, a whale can split tokens across many wallets. We show that the best split gives back voting power that is linear in the budget, whatever the fees.
Circle Research, USA
In three numbers · Table 2
We replayed the ten most recent finalized proposals of five major DAOs and asked how much capital an attacker needs to match all the honest voting power on each one.
Mean cost, tokens plus gas, to match every honest vote. The same control costs \$302.6M under linear voting.
How many times cheaper the attack is under QV than under one-token-one-vote, from ZKsync to Uniswap.
Uniswap under the steeper power rule $f(w)=w^{0.25}$: control for a mean of \$1.3K.
The problem
Most DAOs give one vote per token, so whoever holds the most tokens at snapshot time wins. Quadratic Voting (QV) is the best-known fix: a wallet holding $w$ tokens gets $\sqrt{w}$ votes. A whale with 10,000 tokens gets only $100$ votes, so many small holders together can outvote them.
But a wallet is just a keypair, and anyone can make as many as they like. Split the same 10,000 tokens into 100 wallets of 100 tokens each, and every wallet casts $10$ votes: $1{,}000$ in total. In general, $n$ wallets give $n\sqrt{w/n} = \sqrt{nw}$ votes.
Chains are not free, so each extra wallet costs a transfer ($s$) and a vote transaction ($v$). The paper shows these fees don't save the rule. The attacker picks the wallet size $w^*$ that maximises votes per token spent, $f(w)/(w+c)$ with $c = v+s$, and fills as many such wallets as the budget allows. Total power becomes $\kappa\,(a-p)$, which is linear in the budget $a$.
Concavity discounts an attacker by a constant factor $\kappa$, but it gives no sublinear dampening at all. The honest voter who keeps one wallet still pays the concave discount; the attacker who splits does not.
Interactive · Lemma 9 and Theorem 10
Choose a budget and a voting rule. Each bar is the attacker's total vote count if the budget is split evenly across $n$ wallets, after paying $c$ per wallet. The best bar is the optimal split, and it sits right at the linear bound $\kappa a$ from Theorem 10.
Model: Figure 3's Uniswap setup. Amounts are in USD. The per-wallet cost is $c = v + s$, where $v =$ is 175,000 gas for delegate + castVote and $s =$ is 65,000 gas for an ERC-20 transfer. Each is gas × gas price × ETH price, averaged over Uniswap's ten proposals in data/processed/. The setup cost $p$ and minimum balance $m$ are both $0$. The attacker's optimum is found by trying every whole number of wallets, as the paper's plotting script does. The single-wallet baseline is $f(a)$ with no fee, matching Table 1.
Interactive · Lemma 8
Take the paper's 10,000-token whale and four wallets. Drag a bar to move tokens between wallets; the total always stays 10,000. Under a concave rule, every uneven split loses votes. This is Jensen's inequality: the total $\sum_i f(w_i)$ can never beat $4\,f(10{,}000/4)$. Under the linear rule, how you split makes no difference.
Drag a bar, or focus it and use the ↑/↓ keys (250 tokens a step).
An illustration of Lemma 8, with no fees. The 10,000-token whale with $\sqrt{10{,}000} = 100$ votes is the paper's own example from the introduction.
Interactive · Figure 1 and Table 2
For each DAO, the grey bar is the mean capital needed to match all honest voting power under linear voting. Splitting doesn't help there. The coloured bar is the Sybil-optimal cost under the chosen concave rule, and each dot is one of the ten proposals. The scale is logarithmic: each gridline is a factor of ten.
Source: data/processed/<dao>_summary.csv, column attacker_cost_usd. Each DAO's bar is the mean over its ten proposals, and the multiplier is the linear mean divided by the rule's mean, as in Table 2. All 20 cells of Table 2 reproduce exactly from these files.
Interactive · Figure 2
Is it the splitting or just the money? Fix the budget at the Sybil-optimal QV cost from Table 2. The grid is all honest QV voting power on the DAO. Switch between holding that budget in one wallet and splitting it across Sybil wallets.
The paper gives the Uniswap single-wallet share as "$\approx 1/259$ ($0.38\%$)". The data gives $1/258.99 = 0.386\%$, which rounds to $0.39\%$. The page shows the value computed from the data. Each share is $\sqrt{a}/V_h$ for one proposal, averaged over ten proposals, as plot_qv_voting_power_scatter.py does. The multipliers match the ones printed on Figure 2: 259×, 140×, 190×, 359×, 240×.
Interactive · Figure 3 and Figure 4 (Appendix B)
Votes per dollar on Uniswap. An honest voter's votes per dollar (dashed) fall towards zero as the balance grows. The attacker's curves flatten at a constant $\kappa$. Raising gas or adding a minimum balance lowers $\kappa$ but leaves the attacker linear. Hover or drag across the chart to read values.
Figure 3's caption and legend describe the frictions as "doubled gas ($2c$)" and "$m = 2$". The script that draws it, plot_attack_uni_vote_per_dollar_costs_kappa.py, actually uses a 3× gas multiplier for both "$2c$" curves and $m = 4$ for the "$2c,\ m=2$" curve. This chart reproduces the curves the paper plots, labelled with the parameters actually used. The conclusion is the same either way: every curve still levels off at a positive $\kappa$.
What the paper proves · Sections 3–5
The model: an attacker with budget $a$ pays a one-time setup cost $p$, then $s$ to fund each wallet and $v$ for each vote. Each wallet must hold at least $m$. The quantity studied is the Sybil-adjusted voting power $V^*(a)$, the most votes any split can buy. A rule is plutocratic if $V^*(a) \ge \gamma\,a$ for large $a$.
| Result | Statement | Holds for |
|---|---|---|
| Lemma 5 | Cutting the budget into wallets of size $m$ gives $V^*(a) \ge \lfloor a/m \rfloor f(m)$. | any rule with $f(m) > 0$ |
| Theorem 6 | Every nontrivial rule is plutocratic: $V^*(a) \ge \tfrac{f(m)}{2m}\,a$ for $a \ge 2m$. | any nontrivial rule |
| Theorem 7 | Adding costs $(m, v, p, s)$ keeps it plutocratic: $V^*_C(a) = \Omega(a)$. | any linear cost scheme |
| Lemma 8 | For a fixed number of wallets, an even split maximises $\sum_i f(w_i)$ (Jensen). | concave $f$ |
| Lemma 9 | With $n$ wallets, the best balance per wallet is $w^* = \frac{a-p}{n} - (v+s)$. | positive, concave, strictly increasing $f$ |
| Theorem 10 | $V^*(W) \le \kappa\,(a-p)$ with $\kappa = \sup_{x \ge m} \frac{f(x)}{x+c}$, and $V^*(W)/(a-p) \to \kappa$ when the supremum is attained. | concave $f$, $c = v+s > 0$ |
| Corollary 11 | Closed forms for power, quadratic and logarithmic voting (Table 1, below). | $m$ slack at the optimum |
$A = a - p$, $c = v + s$.
| Voting rule | One wallet $V(W)$ | Sybil-optimal $V^*(W)$ |
|---|---|---|
| Linear | $a$ | $a$ |
| Quadratic | $\sqrt{a}$ | $\dfrac{a-p}{2\sqrt{v+s}}$ |
| Power, $\beta \in (0,1)$ | $a^{\beta}$ | $\dfrac{(a-p)\,\beta^{\beta}(1-\beta)^{1-\beta}}{(v+s)^{1-\beta}}$ |
| Logarithmic | $\ln(a+1)$ | $\dfrac{(a-p)\,W_0\!\left(\frac{v+s-1}{e}\right)}{v+s-1}$ |
Binding votes to people caps the number of wallets. It is necessary but not sufficient: it breaks the linearity result only if acquiring credentials costs more than capturing the vote is worth.
Bonds, longer snapshot look-backs and age-weighted voting raise $p$ and $s$. By Theorem 10, they only lower the slope $\kappa$. Superlinear fees would need wallets linked to people, which is the identity problem again.
A bicameral design (a concave chamber plus a linear one) or an identity quorum (at least $k$ verified people must vote yes) stops Sybil splitting from being enough by itself.
Measured results · Section 6
Mean capital in USD to match all participating honest voting power, over ten proposals per DAO. Parentheses give the Sybil amplification factor: how many times cheaper the attack is than under linear voting.
| Data | Address-level votes from Tally for the ten most recent finalized proposals of ENS, Compound, Uniswap, Arbitrum and ZKsync, as of April 2026 (50 proposals). |
|---|---|
| Ethereum L1 | ENS, Compound, Uniswap: $s$ = 65,000 gas (ERC-20 transfer), $v$ = 175,000 gas (delegate + castVote), at Etherscan gas prices on each proposal's creation date. |
| L2 rollups | Arbitrum, ZKsync: a conservative 500,000 gas for both splitting and voting, at historical L2 base fees. |
| Prices | CoinGecko spot prices on each proposal's creation date. The setup cost $p$ is set to $0$. |
| Method | For each proposal, sum the honest power $\sum_i f(w_i)$, solve $V^*(W) = \sum_i f(w_i)$ for the attacker budget $a$ using the closed forms, and convert to USD. |
| Caveat | Honest voters are assumed to keep their historical weights. A visible attack might bring out more defenders. |
Cite
@misc{bennett2026concave,
title = {Concave is the New Linear: Sybil Attacks Collapse
Anti-Plutocratic {DAO} Voting},
author = {Bennett, Austin and Vander Vos, Preston and
Belenkiy, Mira and Le, Duc V.},
year = {2026},
eprint = {2605.18990},
archivePrefix = {arXiv}
}
arXiv v1 (2605.18990) was posted under an earlier subtitle, "The Impossibility of Anti-Plutocratic DAO Governance", with a different author order. The PDF linked above is the current version.
Code and data: the paper has no code or data availability statement, so no repository is linked here.