Dual Governance 101: Explainer

Introducing Dual Governance: Giving stETH Holders a Voice

There is an inherent tension in DAO-run systems: those who shape the protocol’s design are not necessarily those who shoulder the outcomes firsthand. The DAO holds upgrade rights, while stETH holders bear the execution risk. Because upgrades are inevitable as Ethereum evolves, this tension only grows.

Dual Governance addresses these concerns by enabling stETH holders to express discontent and exit the protocol if confronted with controversial LDO-governance decisions.

At its core, Dual Governance represents a dynamic timelock: the more exit signals stETH holders submit, the longer LDO-governance motions are delayed.

This achieves two aims at once:

1. Makes contention visible and measurable.
2. Gives stakers the option to exit safely, avoiding unfavorable protocol changes.

Here is how it works, why it matters, and the key parameters that make it effective.

The Core Idea: The Right to Exit & Balanced Power

1. Right to Exit Safely: stETH holders can withdraw their stake if they oppose governance decisions, preventing forced changes to their crypto-assets.
2. Balance of Interests: No single group (LDO holders, node operators, or stakers) can unilaterally push harmful changes on stakers. Each has a voice, and strong disagreements trigger a built-in pause for negotiation or exit.

Why It’s Needed: The Risk of Governance Attack

Ethereum’s validator-exit queue can delay withdrawals for weeks or months during congestion. In that window, a hostile majority of LDO tokens could force smart-contract upgrades, eject node operators, or reassign user-withdrawal addresses.

Dual Governance mitigates such extreme scenarios by allowing stETH holders to voice disagreement and by blocking protocol governance for the time needed to exit.

This makes large-scale takeovers costly and impractical, enhancing the protection of Lido participants and, indirectly, Ethereum itself.

How Dual Governance Works

Dual Governance adds a “sentiment gauge” that lets stETH holders delay LDO-governance execution when opposition rises.

Ultimately, the contention is either mediated or—if an active governance attack targets protocol users—stakes can be withdrawn safely through the rage-quit gate.

The more stETH that signals disagreement, the longer the execution delay. Once opposition reaches a major threshold (10 % of TVL), governance cannot execute any change until the opposing stakers withdraw their tokens.

Key Scenarios: When Dual Governance Matters

Scenario 1: Voicing Opposition and De-escalation

• LDO holders propose removing a node operator, unaware of critical reasons to keep them.
• stETH holders signal a veto, triggering a temporary pause.
• LDO holders reconsider and cancel the proposal.
• Governance continues as usual without harming user trust.

Scenario 2: Reacting to Takeover—Guaranteed Exit

• A large LDO-holding entity proposes a smart-contract change that jeopardizes user tokens.
• Enough stETH holders lock tokens in the veto-signalling contract, delaying execution.
• stETH holders exit if LDO holders refuse to cancel.
• After withdrawals complete—or the proposal is canceled and stETH holders have unlocked their tokens—governance resumes.

Dual Governance Design

Dual Governance inserts a timelock between Lido-DAO decisions and execution. It is linked to an escrow where stETH holders can signal intent to exit by locking stETH, wstETH, or withdrawal NFTs.

Once deposits cross the first-seal threshold (1 % of Lido-on-Ethereum TVL), the timelock starts to grow. Reaching the second seal (10 % of TVL) triggers rage quit—execution is fully blocked until all locked stake is withdrawn to ETH.

All contracts have undergone multiple independent audits, ensuring the code meets the highest security standards.

The system has undergone third-party design reviews from Certora and Runtime Verification. Audit reports are available from Certora, Statemind, OpenZeppelin, and Runtime Verification.

All proposed parameters were tested by two independent teams: game-theoretic research by 20squares and agent-based modeling by CollectifDAO.

Proposal Lifecycle

When the DAO (i.e., LDO holders) supports a proposal—such as upgrading a smart contract or adding a node operator—it does not execute immediately. Instead, it enters a four-day waiting period. During this time, stETH holders can trigger Veto Signaling by locking tokens.

If triggered, a dynamic timelock replaces the standard delay, extending the waiting period according to the amount of stETH committed (from five extra days at 1 % to a maximum of 45 days at 10 %). During this period:

• The DAO can still cancel pending proposals if contention is visible.
• stETH holders may escalate by locking more stETH, further extending the timelock or eventually triggering a rage quit.

Once the timelock expires, the proposal can be executed, allowing on-chain changes to take effect.

Governance States

Dual Governance follows a state-machine model, each state imposing specific rules:

1. Normal: Default state; proposals spend four days pending, then can be executed.
2. Veto Signaling: Triggered when 1 % of stETH supply is escrowed in opposition. The proposal is paused under a dynamic timelock, which expands from five to 45 days proportional to stETH opposition.
3. Rage Quit: If 10 % of stETH remains locked until the timelock ends, stakers exit. No new proposals can execute until withdrawals finish, shielding users from the contested motion.
4. Veto-Signaling Deactivation and Veto Cooldown: Technical sub-states that resolve edge cases; only pending proposals may execute during Veto Cooldown.

The Role of Committees: Fine-Tuning Governance Resilience

Dual Governance introduces three new committees that cover different areas:

1. Reseal Committee

A safety net that extends the withdrawal pause triggered by GateSeal.

• GateSeal: Pauses withdrawals for 11 days if a critical issue is detected.
• Reseal: Extends GateSeal’s pause when Veto Signaling is active, giving the DAO more time to act.

2. Tiebreaker Committee

A last-resort measure for unlikely stalemates.

• Can force execution of stuck proposals or unseal withdrawal contracts.
• Activates only after long-term governance paralysis.

Structure: A “multisig of multisigs” comprising three subcommittees:

• Ethereum Ecosystem (3/5 quorum)
• Builders (3/5 quorum)
• Node Operators (5/7 quorum)

At least two of the three subcommittees must reach quorum. All members are external to avoid conflicts of interest.

3. Emergency Committee

Purpose: Safety mechanism for the first year after deployment.

• Can pause Dual Governance, halt permissionless execution, and temporarily restore LDO-token governance.
• May execute proposals while DG is disabled to restore stability.

Composition

• Activation multisig (4/7): May trigger emergency mode once, within a limited window.
• Execution multisig (5/7): Temporarily controls governance logic to fix or revert.

Designed as a one-off failsafe, not a standing power.

Conclusion: Solid governance model for Liquid Staking on Ethereum

One of the key properties of DeFi is the user's right to exit, and Dual Governance implements it for Lido on Ethereum. While catering to Ethereum staking mechanics requires an intricate design, the resulting mechanism aims for resilience, mitigating even theoretical edge cases.

The very release of Dual Governance shifts the game theory around the protocol's upgrade levers, mitigating heavy risk vectors without ever being triggered.

While it won't prevent every potential governance risk, it makes large-scale attacks impractical and rebalances power toward those with the most at stake.