Zodiac is the missing piece between how most DAOs vote and how they act. A community runs its polls on Snapshot – gasless, off-chain, and non-binding – while its money sits in a Safe multisig that only a handful of signers can move. Between the two is a gap: something has to take a passed vote and actually execute the transaction, and for years that "something" was a small human multisig trusted to faithfully carry out the community's decision. Zodiac, an open contract standard built by Gnosis Guild and first released in 2022, is the toolkit that closes that gap – letting a Safe execute the outcome of a vote directly, on trust-minimised rails, without handing a multisig the keys to the treasury.
Zodiac's power is that it is a standard, not a single product. Per the Zodiac specification, it defines four composable roles around a programmable account:
IAvatar interface, whose execTransactionFromModule function is how everything else moves it.Because each role is just an interface, the pieces snap together like an expansion pack: you can chain a Delay modifier behind a Reality module behind a Safe, and the Safe neither knows nor cares which combination it is. That composability – rather than the monolithic, all-or-nothing design of a full framework like early Aragon – is the whole thesis.
The flagship module – originally shipped as SafeSnap and now the Reality Module – is what lets an off-chain Snapshot vote move an on-chain treasury. When a community drafts a Snapshot proposal, it can attach an array of transaction payloads to be executed if the vote passes. The outcome is then posted as a question to the Reality.eth optimistic oracle: anyone can assert "this proposal passed," a bond backs the assertion, and unless someone bonds a counter-claim within a challenge window, the result finalises.
Disputes can escalate to Kleros arbitration. Once the answer resolves and a cooldown elapses, the transactions become executable by anyone through the Safe – the multisig is out of the loop entirely. The oracle, not a trusted signer, is what asserts the off-chain vote's result on-chain, which is why this pattern is called optimistic governance. A sibling module, the Optimistic Governor, does the same job against UMA's optimistic oracle instead of Reality.eth.
The other modules address the everyday failure modes of running an on-chain organisation:
rageQuit() into a bolt-on any Safe can install (zodiac-module-exit, Exit App launched April 2022). It is the clearest on-chain expression of a member's right to exit: dissent by withdrawal rather than by vote.Roles is the one that grew, and it now has three tracks. v1 is legacy and still runs but gets no new features; v2 is current, at mastercopy 2.1.1, deployed at one address on every supported chain; v3 has no deployments yet and adds session keys, expiring roles and allowances denominated in a base asset (Zodiac). The documentation names the organisations using it as Safe, ENS DAO, Balancer, Gnosis DAO, Gnosis Pay and kpk, the treasury manager formerly called karpatkey, which layers a sub-roles contract of its own on top.
On 1 June 2026 an attacker bypassed authentication in Roles 2.1.0 and Delay 1.1.0. Gnosis Guild’s post-mortem, published on 19 June, rates it critical and puts the cause in one sentence: the modules’ ERC-1271 check – the standard by which a contract rather than a private key signs a message – treated a signature as valid on the returned magic value alone, without verifying that the call to the signer contract had actually succeeded. It bit only in a particular composition, where a Safe using the default fallback handler was an enabled module of a Delay or a member of a role, which the Guild puts at roughly 49,800 affected accounts, 46,669 of them Gnosis Pay wallets.
The figures are worth recording because they are unusually specific. Value at risk attributable to Roles was about $85.5m, of which some 99.77% was secured before it could be taken; for Delay the figure was 99.18%; and confirmed loss outside Gnosis Pay was about $4,500 across roughly thirty accounts. Patched mastercopies shipped on 19 June after an audit. Two things generalise. The loss stayed small partly because most Roles permission sets did not allow draining funds in the first place, which is the least-privilege argument paying out. And the hole was in the composition rather than in either contract alone, which is the cost of composability stated as an incident rather than as a caution (Zodiac).
Zodiac occupies the execution and permissioning layer of the DAO tooling stack – the connective tissue between the voting layer (Snapshot), the custody layer (Safe), and the binding on-chain governance that tools like Tally / Cactus front. Its appeal to large DAOs is that it lets them keep cheap, high-participation off-chain voting and get trust-minimised execution, without adopting a heavyweight on-chain Governor for every decision. The trade-off is assembly: a Zodiac-based DAO is a set of modules a team wires together and must configure correctly, and a misconfigured module or oracle is its own attack surface – the price of composability is that no single vendor hands you a finished, audited whole.
What sits in that layer in 2026 is also a business, and the page above describes the 2022 project. The contracts moved out of the zodiac repository into zodiac-core, leaving the old package as an address registry and CLI; the documentation covers Roles, Delay and the Pilot browser extension and nothing else; and zodiac.eco sells the platform by subscription – a free tier capped at $1m of assets under management and $100k of monthly transaction volume, a Starter tier at $250 a month, and an Enterprise tier, with the page stating there are no transaction fees and no cut of the value moved. The SDK publishes under a separate company, Zodiac Labs GmbH, whose GitHub organisation was created in May 2026. The contracts stay LGPL and the standard stays open; what is priced is the operating layer around them.
The Snapshot-execution modules that made Zodiac’s name are the part left behind. Reality (SafeSnap) and Exit still exist as mastercopies and as wizards in the Safe app, and Gnosis Guild has published no deprecation for them, but neither appears anywhere in the current documentation, and the Guild’s own research attention has moved to the Interfold, the encrypted-voting network formerly called Enclave, which this wiki covers under private and shielded voting. A DAO wiring a vote to a treasury today is doing it with tooling its author no longer documents.
Zodiac exists because, in the mainstream stack, voting, custody, execution and exit are separate contracts a DAO must bolt together – and each seam is a place where a multisig, an oracle, or a misconfiguration can sit between the members and their treasury. Caper takes the opposite route: those layers are one contract. A caper's proposals, votes and execution are native to the protocol, so there is no SafeSnap-style bridge to trust – a passed proposal is the authorisation to execute.
The contrast is sharpest at the Exit Module. Zodiac's exit is an optional add-on that returns a share strictly proportional to a redeemable token's balance. In Caper, exit is not a module you choose to install – every member who has voted holds it by construction, and the share is weighted by the same earned metric that sets voting power.
A member who has voted can redeem their caper tokens together with their soulbound votes at any time for their fair share of the treasury, and the same earned weight that sets their say when they vote sets what they take. The vote tokens are soulbound and non-transferable, so exit weight is earned participation, not just a token you can buy on the way out. The right to leave with your fair share isn't a feature a caper's founders remembered to enable – it's the same primitive as the right to be heard.