  Decentralized Autonomous Organizations (DAOs) are blockchain-based
organizations that facilitate decentralized governance. Today, DAOs not only
hold billions of dollars in their treasury but also govern many of the most
popular Decentralized Finance (DeFi) protocols. This paper systematically
analyses security threats to DAOs, focusing on the types of attacks they face.
We study attacks on DAOs that took place in the past, attacks that have been
theorized to be possible, and potential attacks that were uncovered and
prevented in audits. For each of these (potential) attacks, we describe and
categorize the attack vectors utilized into four categories. This reveals that
while many attacks on DAOs take advantage of the less tangible and more complex
human nature involved in governance, audits tend to focus on code and protocol
vulnerabilities. Thus, additionally, the paper examines empirical data on DAO
vulnerabilities, outlines risk factors contributing to these attacks, and
suggests mitigation strategies to safeguard against such vulnerabilities.
