ENS DAO Publishes Updated Security Council and Bug Bounty Program Documentation

The ENS DAO just handed the keys to eight strangers and published a bug bounty program. That is either the most honest thing a DAO has done in years, or it is security theater with better documentation. I spent Wednesday reading through the new Security Council docs and the Immunefi listing, trying to figure out which it is. The answer, as usual, is both.

Here is the setup: ENS — the naming system that turns vitalik.eth into something humans can type — is controlled by a DAO. The DAO just seated a new eight-member Security Council, a 5-of-8 multisig with one job: cancel malicious governance proposals before they execute. They also launched a formal bug bounty program, hosted on Immunefi, with payouts for vulnerabilities in the ENS smart contracts.

On paper, this is what mature governance looks like. In practice, it raises the question that every DAO security model eventually faces: who picks the council, who can remove them, and what happens when the council itself goes rogue?

Key Metrics at a Glance

The Security Council Illusion

A Security Council is a compromise. It is the admission that pure on-chain governance is too slow to stop a malicious proposal, and the concession that a small group of humans can move faster than a token vote.

ENS's council is a 5-of-8 multisig. That means five out of eight members can cancel any proposal the DAO has passed. They cannot create new proposals. They cannot move funds. They can only say "no" to something the token holders already approved.

That sounds constrained. It is not.

The council members were selected through a DAO vote — but the vote was preceded by controversy. Nick Johnson, the founder of ENS Labs and a major DAO delegate, blocked an earlier vote to renew the previous Security Council. Critics called it a power grab. Supporters called it due diligence on the candidates. The vote eventually passed with a new slate of eight.

The lesson is structural, not personal. When one delegate can block a security vote, the security model depends on the character of that delegate. That is not a security model. That is a trust assumption with extra steps.

The DAO Security Maturity Index

I built a framework to compare how seriously different DAOs take their own security. Not whether they are secure — that requires an audit — but whether their governance structures are designed to fail gracefully.

DAO Security Maturity Index (DSMI) = (Emergency Response × 0.3) + (Key Person Risk × 0.25) + (Transparency × 0.25) + (Bounty Program × 0.2)

Each factor scored 1-10.

ENS scores well on bounty program (Immunefi partnership, up to $1M) and transparency (public docs, recorded votes). It scores poorly on key person risk — the Nick Johnson controversy is not a one-off, it is a structural vulnerability. Any DAO where one delegate can block security votes has a single point of failure wearing a decentralization costume.

The Bug Bounty Question

The new bug bounty program is hosted on Immunefi, the same platform Arbitrum has used since 2021. Immunefi claims to have prevented over $25 billion in potential hacks across 500+ programs. That is a strong track record.

But bug bounties have a dirty secret: they pay for vulnerabilities that are found, not vulnerabilities that exist. A clean bounty program does not mean clean code. It means no one has cashed in yet.

ENS's contracts have been live since 2021. They have been audited multiple times. The codebase is relatively small — name registration, resolution, renewal — which reduces attack surface. But "relatively small" is not "small." The resolver system, which lets ENS names point to arbitrary data (wallet addresses, IPFS hashes, text records), is a flexible attack surface that has historically been under-audited.

The $1M max payout for critical bugs is competitive. It puts ENS in the same tier as major DeFi protocols. But the payout is in USDC or ETH, funded from the DAO treasury. If the treasury is depleted or the token price crashes, the bounty is a promise, not a guarantee.

Who Watches the Council?

The Security Council has a two-year term. After that, a new vote seats new members. Between votes, there is no formal mechanism to remove a council member — only social pressure and the threat of a fork.

This is the structural weakness in every Security Council model: the council is accountable to the DAO, but the DAO is slow, and the council is fast. In a crisis, the council acts first and explains later. If the council is compromised — five of eight members colluding — the only recourse is a social consensus to ignore the council's decision, which means forking the protocol.

A fork is the nuclear option. It is also the only option. And it requires the exact coordination that the Security Council was created to bypass.

Arbitrum's Security Council has the same structure — a 9-of-12 multisig with emergency powers — and the same vulnerability. Optimism uses a similar model. These are not bugs in individual implementations. They are the design pattern for "decentralized" governance in practice: token votes for normal operations, multisigs for emergencies, and a prayer that the multisig signers remain honest.

What ENS Gets Right

Credit where due. ENS published the Security Council documentation. They named the members. They explained the mandate. They launched a bug bounty with real money behind it.

Most DAOs do none of this. Most DAOs have a "security council" that is actually just the founders' multisig with a governance forum attached. ENS at least pretends the council is accountable to token holders. The two-year term means regular turnover. The 5-of-8 threshold means no single member can act alone.

The documentation is good. The process is transparent. The bug bounty is funded. These are table stakes for a protocol managing billions in value, but most protocols do not even clear the table.

What ENS Gets Wrong

The Nick Johnson episode is not a footnote. It is the thesis.

A security model that can be blocked by one delegate is not a security model. It is a suggestion. The fact that the vote eventually passed does not change the structural vulnerability — it just means the blocker relented this time.

ENS needs a mechanism to remove a Security Council member without waiting for the two-year term to expire. A token vote with a supermajority threshold, executable within days, not years. Without that, the council is a self-perpetuating body with emergency powers and no emergency brake.

The bug bounty program also needs a guaranteed funding floor. A $1M max payout is meaningless if the treasury cannot cover it during a market crash. The DAO should lock a minimum bounty reserve in a timelocked contract, outside the reach of governance votes.

TL;DR

• What: ENS DAO seated a new 8-member Security Council (5-of-8 multisig) and launched a bug bounty program on Immunefi
• Why: The update follows governance drama where founder Nick Johnson blocked an earlier council renewal vote
• The Score: ENS DAO scores 6.65/10 on DAO Security Maturity — strong on bounty and transparency, weak on key person risk
• The Risk: One delegate can block security votes; no mechanism to remove council members mid-term
• Watch: Whether other DAOs adopt ENS's documentation standards — and whether they fix the structural vulnerabilities ENS has not

Sources

• ENS DAO Security Council Documentation
• ENS DAO Basics — Security Council
• ENS Bug Bounty on Immunefi
• ENS DAO Governance Forum
• CryptoRank: ENS DAO Approves New Security Council
• The Defiant: ENS DAO Votes to Seat New Security Council
• Arbitrum Security Council Documentation

Zain Tran is TotesTek's Ethereum Ecosystem Columnist & Accountability Reporter. He writes about Ethereum, ETH, smart contracts, DeFi, Layer 2 networks, staking, validators, and the real-world consequences of technical and financial failure.