Rabby Wallet for DAOs and Governance: Voting Power, Delegation, and Treasury Management

A DAO member holds governance tokens across multiple EVM chains and must regularly vote on proposals, approve treasury allocations, and delegate voting power to trusted contributors. The operational challenge is not simply holding the tokens, but managing governance participation safely across several networks while avoiding contract-level risks such as malicious delegation parameters, forged vote transactions, or treasury drain attacks. A self-custody wallet that performs pre-transaction risk scanning before signing becomes essential infrastructure for this workflow.

Rabby Wallet addresses this need as an open-source browser extension that works across Chrome, Brave, and Microsoft Edge, with additional mobile and desktop versions available. Its multi-chain support spans Ethereum and EVM-compatible networks where most governance contracts operate, while its pre-transaction risk detection can flag problematic proposals before a DAO member approves them. The combination of self-custody control, network visibility, and scanning features creates a foundation for secure governance participation, though the user’s diligence in reviewing proposals, understanding delegation mechanics, and verifying contract addresses remains the decisive factor in avoiding loss.

Why self-custody matters in DAO governance

Custodial governance platforms centralize voting power, token balances, and delegation logic on their servers. In that model, a user’s governance participation depends on platform availability, staff integrity, and the platform’s security measures. If the platform experiences downtime, a member may miss a critical vote window. If the platform is compromised, voting records or delegations could be altered without the member’s knowledge. A self-custody wallet such as rabby wallet eliminates the intermediary by keeping the user’s private keys and recovery phrase under their direct control.

This architecture means that voting transactions originate from the member’s own address and are signed locally before broadcast. The wallet cannot vote on behalf of a user, freeze governance tokens, or claim voting power that was not explicitly delegated. If a DAO proposal contains problematic terms—such as an excessive treasury transfer, a malicious contract upgrade, or a governance parameter change—the member can review the transaction details, see the risk scanner’s warnings, and refuse to sign. No platform decision overrides that choice.

The trade-off is individual responsibility. If a user loses their recovery phrase, there is no account recovery service. If they approve a malicious governance contract by mistake, the transaction is permanent. Self-custody therefore requires a more deliberate approach to security and transaction review than custodial platforms demand. For active DAO participants voting regularly or managing delegation, that responsibility is often justified by the independence it provides.

In practice, many governance-active users operate with multiple wallets. A high-value governance account might hold tokens in a hardware wallet, connected only when voting or delegation changes are required. A more active participation wallet could run in the browser, used for checking proposals and previewing transactions. This separation reduces the daily exposure of large token balances while keeping governance participation fast and accessible.

Setting up Rabby Wallet for secure governance participation

The initial setup determines the foundation for all subsequent governance activity. Downloaded directly from rabby.io or official app stores on Android and iPhone, Rabby Wallet presents the choice between creating a new wallet or importing an existing recovery phrase. For governance purposes, many DAO members prefer to import an existing account rather than create a new one, allowing them to connect to an existing governance token balance without transferring funds or exposing the underlying address through a new deposit.

Once imported or created, the wallet should be secured immediately. The recovery phrase must be stored offline in a location that is physically secure and protected from photography, screenshots, or digital access. For high-value governance positions—such as a DAO treasurer or core contributor with large voting power—a hardware wallet integration offers additional isolation. Rabby Wallet can connect to hardware devices through its UI, allowing private keys to remain on the device while governance transactions are signed and approved there, not on the computer itself.

The wallet’s balance display on its dashboard shows assets across all connected networks, which is useful for tracking governance token positions distributed across multiple chains. A DAO member voting on several protocols can see at a glance which accounts have delegated voting power and which do not. Before participating in any governance action, the member should verify that the correct network is selected—Ethereum mainnet, Polygon, Arbitrum, or another EVM chain hosting the DAO’s contracts. Switching networks without noticing can cause transactions to be broadcast to the wrong address or contract.

The pre-transaction risk scanning feature in Rabby Wallet should be understood before governance work begins. This feature analyzes a transaction before signing, checking for known malicious contracts, unusual value transfers, or contract interactions that might drain funds or steal tokens. It is not a complete guarantee of safety, but it provides a meaningful early warning for certain classes of attack. A member should review the scanner’s output carefully rather than dismissing warnings.

Understanding DAO governance contracts and voting mechanics

Most EVM-based DAOs use standardized voting mechanisms: members hold governance tokens, those tokens carry voting power, proposals are submitted with transaction data that will execute if the vote passes, and members vote yes, no, or abstain. The voting power is often weighted by token balance at a specific block number, called the “voting snapshot,” which prevents members from buying tokens after a proposal is announced and instantly inflating their voting influence. Understanding this timing is essential because voting power is historical, not live.

A governance member must first check when they acquired their governance tokens and whether the token balance was held before the snapshot block of a given proposal. A member who receives tokens after the snapshot cannot vote on that proposal, even if the tokens are now in their account. Conversely, a member who held tokens at snapshot time retains voting power even if they sell the tokens afterward—though best practice is to retain them so delegation remains unambiguous. When using Rabby Wallet for dApps that query voting power, it will return the balance at the user’s currently held address, not necessarily at the historical snapshot block needed for a particular proposal.

Voting contracts also often include parameters that affect voting windows. A proposal may have a voting delay before members can vote, a voting period during which votes are counted, and a queue delay after voting ends but before execution. Missing any of these windows means a member’s vote will not be recorded. Rabby Wallet DeFi features can help a member monitor when voting is active on chains they use, but the wallet cannot force a vote to count if the window has closed.

The distinction between voting power and token custody is important. A member’s governance tokens can be held in a self-custody wallet like Rabby Wallet, but the voting power is determined by the DAO’s governance contract. If tokens are delegated to another address, that delegated address holds the voting power, not the token holder. A member can hold tokens and vote if the tokens are not delegated, or they can delegate their voting power to a representative while keeping custody of the tokens themselves. Each pattern has different implications for treasury access, revenue distribution, and governance participation.

Delegation workflows and representative selection

Delegation is a core governance feature where a member transfers their voting power to another address without transferring the tokens themselves. This is useful when a member lacks time to research proposals, trusts another contributor’s judgment, or wants to concentrate voting power among a smaller group of informed participants. In Rabby Wallet, delegation happens through a transaction that calls the governance contract’s delegate function, specifying the recipient address.

Choosing a delegate is a risk decision that merits careful thought. If a member delegates to a malicious or careless address, that delegate controls the member’s voting power for all proposals until the delegation is changed. There is no way to un-vote a proposal after the delegate has voted on it; the member must re-delegate to regain control. For this reason, many DAO members delegate only to addresses they have direct relationships with or to addresses that have demonstrated consistent participation and transparency over many governance cycles.

When setting up delegation using Rabby Wallet DeFi features, the member should confirm the delegate address carefully. A phishing attack might present a similar-looking address or suggest delegation to a compromised account. If the governance contract is well-known and frequently used, the wallet’s risk scanner may have rules that warn about suspicious delegate addresses. However, novel scams or newly compromised addresses may not be flagged yet, so the user’s own verification—checking the delegate address against public records, team websites, or governance forums—remains essential.

Delegation can also be self-delegation, where a member delegates voting power to their own address. This is sometimes required by governance contracts to activate voting power explicitly, even though no power is actually transferred. If a member holds governance tokens but finds they cannot vote, checking whether the contract requires self-delegation is one of the first diagnostic steps. The delegation transaction must be signed through Rabby Wallet and broadcast to the correct network.

Treasury management and fund movement approval

DAO treasuries often hold significant assets across multiple EVM chains. Governance members may vote on proposals to move treasury funds—sending tokens to team members, deploying capital to protocols, or bridging assets between chains. Each treasury transaction requires approval, and members may be asked to sign multisig transactions if the DAO uses a multisig wallet to secure treasury control.

When reviewing a treasury proposal in governance, a member should examine the actual transaction that will execute if the proposal passes. This means finding the proposal details on the governance interface, looking at the encoded function call, and ideally decoding it to see the actual destination addresses and amounts. A proposal might claim to be “sending 100 tokens to the treasury,” but the encoded transaction could be sending 10,000 tokens to an unexpected address. Malformed or deceptive proposals are not always obvious from the proposal title or summary.

Rabby Wallet’s balance change preview feature is particularly valuable here. Before signing a transaction, the wallet shows what balances will change and by how much. If a member is voting to approve a treasury transaction and the preview shows a much larger token amount leaving than expected, that discrepancy is an immediate red flag. The wallet’s risk scanner may also flag transactions that interact with unfamiliar contracts or move unusual amounts.

For treasury operations that require multisig approval—such as a Gnosis Safe with a 3-of-5 threshold—DAO members may be asked to sign as one of the required signers. In that case, the member will import or view the multisig contract through Rabby Wallet, review the pending transaction, sign it locally, and submit their signature. The transaction does not execute until enough signers approve it. This distributed approval process reduces the risk that a single compromised account can drain the treasury, but it also means treasury operations are slower and require coordination among multiple parties.

Navigating governance risks and contract interactions

Not all governance contracts are well-designed or secure. Some DAOs have launched with governance vulnerabilities, governance-token-based contracts have been hacked, and members have voted to approve proposals without fully understanding what they were voting for. Understanding the categories of risk helps a member use Rabby Wallet more effectively as a protective layer.

The first risk is incompleteness: a member votes on a proposal but doesn’t understand what the encoded transaction actually does. This is where examining the proposal details before signing is essential. If a proposal is complex, asking for community review on governance forums or Discord before voting can reveal problems. If the encoding is not clear from governance interfaces, tools exist to decode transaction data; Rabby Wallet does not do this automatically, but the member can copy the transaction data and verify it externally before signing.

The second risk is governance attack: a malicious actor proposes a transaction that would drain the treasury, transfer tokens to themselves, or change governance parameters to lock other members out of voting. In many DAOs, there is a quorum requirement and voting delay to prevent this, but not all DAOs have equally robust protections. Rabby Wallet’s risk scanner can catch some obviously malicious contracts, but novel attacks may not be in the scanner’s database. Community awareness and active discussion of governance proposals are therefore critical defenses.

The third risk is accidental misconfiguration: a valid governance proposal has a typo in an address, accidentally approves the wrong contract, or routes funds to a deprecated protocol. This is why reviewing transactions in Rabby Wallet’s preview before signing is important. The wallet cannot catch every mistake, but comparing what the proposal claims against what the actual transaction data shows catches many errors.

Best practices for ongoing governance participation

Active DAO members using Rabby Wallet should establish repeatable habits to reduce the risk of governance mistakes. Before every vote, find the proposal text, find the encoded transaction data, decode if necessary, and compare the two. If they don’t match, do not vote. Before every delegation change, verify the delegate address independently. Before every treasury approval, check the balance change preview and confirm that it matches the proposal description.

Documentation matters more in governance than in casual trading. Keep a record of which proposals were voted on, how each vote was cast, and which delegates are active. This is useful for personal reference when reviewing governance history, and it also creates a record that can be compared against the on-chain transaction history if discrepancies emerge. Rabby Wallet records on-chain activity, but it does not automatically summarize governance actions, so manual notes provide a useful parallel.

For members who participate in governance across multiple DAOs or EVM chains, using separate browser profiles or separate hardware wallet keys for different governance roles can reduce the risk of one key being over-exposed. A core team member managing treasury operations might use a different key than a member voting on routine proposals. This doesn’t require separate wallets entirely; Rabby Wallet can manage multiple accounts in a single installation, and the user can switch between them. The separation of responsibility is the key security principle.

When proposing new governance actions, a member should test the encoded transaction on a testnet before asking the DAO to vote. This can catch parameter errors, address mistakes, or contract incompatibilities before they are broadcast to the mainnet and voted on. Rabby Wallet can connect to testnet networks, so a member can preview a treasury transaction on Ethereum Sepolia or another testnet before proposing it to the full DAO on mainnet.

Keeping private keys safe while maintaining accessibility

The security of governance participation ultimately depends on the security of the private keys signing the transactions. A compromised key means an attacker can vote on behalf of the member, delegate voting power to themselves, approve treasury transactions, or perform any other action the key would normally authorize. Rabby Wallet keeps private keys on the user’s device by default, but device security determines whether those keys remain private.

For lower-value governance roles, a key on a computer that is routinely used for web browsing, email, and other activities carries inherent risk. Browser extensions themselves are a relatively exposed attack surface compared to hardware wallets. A compromise of the browser, a malicious script injection, or a phishing attack could expose the key. For members with large voting power or treasury responsibilities, using a hardware wallet with Rabby Wallet provides isolation: the key never leaves the device, and transaction approval requires physical interaction on the hardware device.

Recovery phrases should be stored offline in a form that is both secure and accessible during an account recovery emergency. Writing a recovery phrase on paper, storing it in a safe, and periodically verifying that it is legible and intact is a practical approach. Encrypting the recovery phrase with a strong password and storing it in a secure digital vault (accessible offline if possible) is another option. The key is that if the computer or phone running Rabby Wallet is lost or compromised, the recovery phrase allows account restoration on another device.

Members should also be aware that Rabby Wallet is distributed as a browser extension for Chrome, Brave, and Microsoft Edge, and as mobile apps for Android and iPhone. Downloads should always come from rabby.io or official app stores to avoid counterfeit extensions that could steal keys or redirect votes. Installing the correct version matters as much as maintaining device security, because a forged wallet can masquerade as the legitimate Rabby Wallet while capturing every transaction approval.