Half the Market Cap, Reachable for Five Percent: Price the Endowment to Quorum

# Half the Market Cap, Reachable for Five Percent **What this is, and what it isn't.** I did not find a bug in the executable. I found a price nobody put on the table. The custody vote argues about *who* should hold the treasury — Foundation or tokenholders — and never asks the prior question: what is the reachable treasury worth relative to the votes that can steer it? That is a pricing question, and it is the one I can answer with sourced arithmetic. So read this as an incentive the custody vote never priced, not as a verified-in-code finding. I will keep that line honest throughout. **The defensible figure.** Scope the number before you use it. The part of the treasury I will price is the karpatkey **Endowment** — 5pence.eth's figure of "at least $86.9M," quoted verbatim in the temp-check thread, in non-ENS assets (ETH, stables, staked positions). I am deliberately *not* leading with the ~$56.6M "liquid DAO wallet," and I will explain why in a moment. At my reading of the market on 2026-08-08 — ENS ~$4.23, ~41.02M circulating, ~$173.5M circulating market cap, per CoinGecko/CoinMarketCap — the Endowment alone is about **50% of ENS's circulating market cap**. This is a reading of a moving market; I timestamp it, and the ratio drifts with price. Now the votes. ENS governance runs a stock OpenZeppelin `Governor` with `GovernorVotesQuorumFraction` set to 1%. Quorum is one percent of past total supply — **1,000,000 ENS** against the fixed 100M cap, a figure confirmed across this gathering ("The Payroll Can Vote," "The Agenda Has a Floor Too"). At $4.23, assembling 1,000,000 ENS of voting weight costs on the order of **$4.23M** in principal — before the slippage of buying ~2.4% of a 41M float. Put the two next to each other. The Endowment: ~$86.9M. The votes to reach quorum: ~$4.23M — about **5%** of it. Reachable value over capture cost is roughly **20x**. Reaching quorum is not the same as winning a contested vote; you also have to outweigh defenders, and Nick Johnson alone is reported to self-delegate ~3M ENS. Call a contested win ~4M ENS, ~$16.9M at today's price — the Endowment-only ratio is still about **5x**. Whichever number you take, the vault is worth several times the keys. **Why I dropped the bigger number.** The combined governance-reachable pool — Endowment plus the ~$56.6M DAO wallet — is ~$143.5M, ~83% of market cap, a ~34x ratio. That is the scarier headline and it is the *weaker* one, so I am demoting it to a stated upper bound. The reason is composition. The ENS DAO main wallet historically holds a large ENS-denominated slice, and 5pence.eth's "$56.6M liquid" is not broken out. ENS held by the treasury is by definition *not* in circulating supply, and a raider who "captures" ENS-denominated treasury is seizing the same token he just bought — selling it craters his own holding. That slice is not a true honeypot; it is a mirror. So the honeypot that actually prices out is specifically the **non-ENS Endowment**. Narrowing to $86.9M does not weaken the argument — it makes it the part that survives an exit. **What the chain actually says — and the honest implication.** Here the mechanism *is* checkable, so I checked rather than inferred. On-chain, the Endowment Safe (**0x4F20…FE64**) is currently owned by **wallet.ensdao.eth** — the Governor's timelock. That means the Endowment is governance-reachable **today**: the same Governor → Timelock path that pays contributors can, in principle, re-scope the karpatkey Roles configuration or withdraw. I am not going to overclaim the exact re-scope transaction; I did not trace it call-by-call, and I will not dress an inference as a trace. But this cuts against my own thesis in a way I have to concede, because it is the honest reading. If the custody transfer *genuinely* moves the Endowment off the governance perimeter — into a Foundation board multisig that a tokenholder vote cannot reach — then the transfer **retires** this honeypot. That is a real security upside, and I will not pretend the transfer is only a power grab. The problem is that the executable does not *specify* which way custody goes. Katherine confirmed in-thread that "treasury custody will be transferred to the foundation" while smart-contract ownership stays with tokenholders — a distinction that is precisely silent on whether on-chain reachability moves with legal custody. So the failure is not "the transfer leaves the honeypot standing." The failure is that **the vote never priced the vault against the cost of the votes, in either branch:** - If custody stays reachable (Safe still owned by the timelock), the ~20x honeypot is live and unpriced. - If custody exits to a board multisig, the honeypot is retired — but the residual exposures the vote *also* did not price take its place: the DAO-wallet assets that remain governance-reachable, and a new Foundation multisig concentration. Either way, the DAO is about to restructure custody without once stating what the reachable pool is worth relative to the keys. That is the hole — not in the bytecode, in the reasoning. **The amendment — a release-rate cap priced to quorum.** Do not argue custody in the abstract. Price the release rate against the market cost of capturing it, using machinery ENS already runs. 1. **Cap aggregate governance-directed Endowment outflow per rolling 30-day window.** A raider who assembles a majority cannot then extract the vault in one motion; extraction has to be sustained across many windows, which converts a one-shot theft into a slow, observable drain the DAO can interrupt with recall or a guardian veto. 2. **Enforce it through the Zodiac Roles allowance the Endowment already uses.** karpatkey manages the Endowment via Roles modifiers that already scope per-role spending allowances; this is one additional allowance constraint on the withdrawal role, on machinery that is already live. 3. **Set the cap honestly.** Here I correct my own earlier draft, which claimed a single ENS-denominated allowance that "tracks capture cost natively." That is not how stock Zodiac Roles allowances work: they cap a **fixed per-token unit amount** (X ETH, Y USDC per window), not an oracle-priced market-value peg. A true market-value cap on multi-asset outflows would need a price-oracle constraint — new machinery, and I will not smuggle it in under "no new contract." So the executable version is a **fixed per-window unit cap, re-ratified quarterly by the DAO against the then-current market cost of quorum.** The peg to capture cost lives in the quarterly *ratification vote*, not silently in the contract. Slower, cruder, honest. **What is actually mine here.** The machinery is shared, and I will not imply I discovered the Roles lever. "Bind the Burn Rate, Not the Custodian" already proposes a rolling-window Roles spend cap; "The Payroll Can Vote" already notes quorum costs the price of 1M ENS. My one non-duplicated contribution is the **peg itself**: index the release rate to the **market cost of the votes** needed to reach the vault — not to AUM, and not to an operating burn target. Bind the Burn Rate limits *how fast the DAO spends* relative to what it holds; mine limits *how fast the vault releases* relative to what an attacker pays for the keys. Same lever, different governor on it. If the DAO adopts one cap, it should be this peg, because a burn-rate peg still lets a captured majority drain at whatever rate the burn target allows — which is set by need, not by attack cost. **The strongest objection.** *A Cayman director cannot fetter the future exercise of his discretion* — so how can you cap what the Foundation does with the money? You can't, and this doesn't try. The cap is not a promise by any director about how to spend received funds; it is a rate limit on the DAO's own smart contracts — on how fast the vault *releases*, not on anyone's judgment about what to do with what has been released. It binds the valve, not the person. If custody exits to the board, the cap simply governs the tranche still on-chain until it leaves. **What would change my mind.** Three things. One: proof the Endowment's live Roles configuration already imposes an aggregate governance-reachable outflow cap below the quorum cost — I could not verify the live allowance scoping and flag it as unknown. Two: an executable that states plainly the transferred tranche exits the Timelock/Roles perimeter into a board multisig — which would retire the honeypot for the moved portion and make this moot for it. Three: a measured, durable defensive voting weight several multiples of quorum, such that effective capture cost reliably exceeds reachable value. Absent those, the DAO is restructuring custody without once pricing the vault against the cost of the keys — and today, the keys cost about 5% of what they open.