How Caper approaches this Zod…t sets voting power. A member redeemingwho has voted can redeem their caper tokens t together with their soulbound votes v receives a treasury fraction of (t · v) / (V · T) – the identical compute_vote_weight formula used when they vote (verified against contracts/common/src/lib.rs)at any time for their fair share of the treasury, and the same earned weight that sets their say when they vote sets what they take. The vote tokens are soulboun…tive as the right to be heard.

Reality Module (SafeSnap): exe… window, the result finalises.Disputes can escalate to Kler…oracle instead of Reality.eth.

How Caper approaches this Zod…metric that sets voting power.A member redeeming caper token…tive as the right to be heard.

Category Execution · Safe (/w…r · Module · Modifier · Guard —– each an interface, freely composable Key modules Reality Moduleoles and Delay – the two the current documentation (https://docs.zodiac.eco/llms.txt) covers. Reality (SafeSnap) ·, Optimistic Governor · Delay · Roles · Exit Source github.com/and Exit are still deployed and still in the Safe app, but no longer documented Security Critical authentication bypass in Roles 2.1.0 and Delay 1.1.0, exploited 1 June 2026; patched mastercopies 2.1.1 and 1.1.1 released 19 June 2026 ( post-mortem (https://engineering.gnosisguild.org/posts/zodiac-post-mortem) ) Source gnosisguild/zodiac-core (https://github.com/gnosisguild/zodiac) · zodiac.eco (https://www.zodiac.eco/) -core) holds the contracts; the older zodiac package is now an address registry and CLI · zodiac.eco (https://www.zodiac.eco/) , a subscription product run by Zodiac Labs GmbH Related Safe (/wiki/dao-gov…/tooling/dao-tooling-overview)

Zodiac is the missing piece be…nce/tooling/voting/snapshot) —– gasless, off-chain, and non-binding —– while its money sits in a Sa… toolkit that closes that gap —– letting a Safe execute the ou…isig the keys to the treasury.

The Avatar / Module / Modifier…ogrammable account: - Avatar —– the account that holds the as…hing else moves it. - Module —– a contract the avatar enables… several at once. - Modifier —– a contract that sits between …alters the module's behaviour —– for example forcing a mandato…and modifiers chain. - Guard —– a contract enabled on a modul…ion it is. That composability —– rather than the monolithic, a…e/tooling/frameworks/aragon) —– is the whole thesis.

Reality Module (SafeSnap): exe…hot vote The flagship module —– originally shipped as SafeSna…guild/zodiac-module-reality) —– is what lets an off-chain Sn…le by anyone through the Safe —– the multisig is out of the lo…oracle instead of Reality.eth.

The rest of the kit: Delay, Ro…ganisation: - Delay Modifier —– enforces a mandatory cooldown…locked one. - Roles Modifier —– grants scoped permissions, so…ry operations. - Exit Module —– lets any holder of a designat…ithdrawal rather than by vote. Roles is the one that grew, and it now has three tracks. v1 is legacy and still runs but gets no new features; v2 is current, at mastercopy 2.1.1, deployed at one address on every supported chain; v3 has no deployments yet and adds session keys, expiring roles and allowances denominated in a base asset ( Zodiac (https://docs.zodiac.eco/developers/roles) ). The documentation names the organisations using it as Safe, ENS DAO, Balancer, Gnosis DAO, Gnosis Pay and kpk, the treasury manager formerly called karpatkey, which layers a sub-roles contract of its own on top. The June 2026 bypass On 1 June 2026 an attacker bypassed authentication in Roles 2.1.0 and Delay 1.1.0. Gnosis Guild’s post-mortem (https://engineering.gnosisguild.org/posts/zodiac-post-mortem) , published on 19 June, rates it critical and puts the cause in one sentence: the modules’ ERC-1271 check – the standard by which a contract rather than a private key signs a message – treated a signature as valid on the returned magic value alone, without verifying that the call to the signer contract had actually succeeded. It bit only in a particular composition, where a Safe using the default fallback handler was an enabled module of a Delay or a member of a role, which the Guild puts at roughly 49,800 affected accounts, 46,669 of them Gnosis Pay wallets. The figures are worth recording because they are unusually specific. Value at risk attributable to Roles was about $85.5m, of which some 99.77% was secured before it could be taken; for Delay the figure was 99.18%; and confirmed loss outside Gnosis Pay was about $4,500 across roughly thirty accounts. Patched mastercopies shipped on 19 June after an audit. Two things generalise. The loss stayed small partly because most Roles permission sets did not allow draining funds in the first place, which is the least-privilege argument paying out. And the hole was in the composition rather than in either contract alone, which is the cost of composability stated as an incident rather than as a caution ( Zodiac (https://docs.zodiac.eco/developers/security) ).

Where it sits in the stack Zo…ooling/dao-tooling-overview) —– the connective tissue between…cle is its own attack surface —– the price of composability is…you a finished, audited whole. What sits in that layer in 2026 is also a business, and the page above describes the 2022 project. The contracts moved out of the zodiac repository into zodiac-core (https://github.com/gnosisguild/zodiac-core) , leaving the old package as an address registry and CLI; the documentation covers Roles, Delay and the Pilot browser extension and nothing else; and zodiac.eco (https://www.zodiac.eco/pricing) sells the platform by subscription – a free tier capped at $1m of assets under management and $100k of monthly transaction volume, a Starter tier at $250 a month, and an Enterprise tier, with the page stating there are no transaction fees and no cut of the value moved. The SDK (https://registry.npmjs.org/@zodiaceco%2Fsdk) publishes under a separate company, Zodiac Labs GmbH, whose GitHub organisation (https://github.com/zodiaceco) was created in May 2026. The contracts stay LGPL and the standard stays open; what is priced is the operating layer around them. The Snapshot-execution modules that made Zodiac’s name are the part left behind. Reality (SafeSnap) and Exit still exist as mastercopies and as wizards in the Safe app, and Gnosis Guild has published no deprecation for them, but neither appears anywhere in the current documentation, and the Guild’s own research attention has moved to the Interfold (https://www.theinterfold.com/) , the encrypted-voting network formerly called Enclave, which this wiki covers under private and shielded voting (/wiki/dao-governance/concepts/voting/private-and-shielded-voting) . A DAO wiring a vote to a treasury today is doing it with tooling its author no longer documents.

How Caper approaches this Zod…acts a DAO must bolt together —– and each seam is a place wher…afeSnap-style bridge to trust —– a passed proposal is the auth… module you choose to install —– every member who has voted ho…fraction of (t · v) / (V · T) —– the identical compute_vote_we…founders remembered to enable —– it's the same primitive as the right to be heard.

References - Gnosis Guild, Zodiac —– composable tooling for onchai…ocs.uma.xyz/resources/osnap) —– retired 15 December 2025. - …co (https://www.zodiac.eco/) . - Gnosis Guild, ERC-1271 authorization bypass post-mortem (https://engineering.gnosisguild.org/posts/zodiac-post-mortem) (19 June 2026); Zodiac security notes (https://docs.zodiac.eco/developers/security) and Roles versions (https://docs.zodiac.eco/developers/roles) ; zodiac.eco pricing (https://www.zodiac.eco/pricing) , read 19 September 2026.

How Caper approaches this Zod… — every member who has voted or traded holds it by construction, and …tive as the right to be heard.

How Caper approaches this Zod… — every member who has voted or traded holds it by construction, and …tive as the right to be heard.

How Caper approaches this Zod…e (verified against contracts/logiccommon/src/lib.rs). The vote tokens …tive as the right to be heard.

How Caper approaches this Zod…ose to install — every member who has voted holds it by construction, and …tive as the right to be heard.

References - Gnosis Guild, Z…(oSnap) (https://docs.uma.xyz/developers/osnap) resources/osnap) — retired 15 December 2025. - Gnosis Guild, zodiac.eco (https://www.zodiac.eco/) .

Category Execution · Safe (/wiki/daos-governance/tooling/treasury/safe) modul…s that turn a Safe (/wiki/daos-governance/tooling/treasury/safe) from …o/) Related Safe (/wiki/daos-governance/tooling/treasury/safe) · Snapshot (/wiki/daos-governance/tooling/voting/snapshot) · Exit rights (/wiki/daos-governance/concepts/membership/rage-quit…) · Tooling stack (/wiki/daos-governance/tooling/dao-tooling-overview)

Zodiac is the missing piece be… polls on Snapshot (/wiki/daos-governance/tooling/voting/snapshot) — g…ney sits in a Safe (/wiki/daos-governance/tooling/treasury/safe) multi…isig the keys to the treasury.

The Avatar / Module / Modifier…ansactions (a Safe (/wiki/daos-governance/tooling/treasury/safe) is th… like early Aragon (/wiki/daos-governance/tooling/frameworks/aragon) — is the whole thesis.

Reality Module (SafeSnap): exe…off-chain Snapshot (/wiki/daos-governance/tooling/voting/snapshot) vot…timistic Governor (/wiki/daos/organizations/infrastructure/uma) , does the… job against UMA (/wiki/daos/organizations/infrastructure/uma) 's optimis…oracle instead of Reality.eth.

The rest of the kit: Delay, Ro…lising MolochDAO (/wiki/daos/organizations/public-goods/molochdao) 's rag…er's right to exit (/wiki/daos-governance/concepts/membership/rage-quit…ithdrawal rather than by vote.

Where it sits in the stack Zo… DAO tooling stack (/wiki/daos-governance/tooling/dao-tooling-overview)…ng layer ( Snapshot (/wiki/daos-governance/tooling/voting/snapshot) ), t…ustody layer ( Safe (/wiki/daos-governance/tooling/treasury/safe) ), and…ike Tally / Cactus (/wiki/daos-governance/tooling/voting/tally) front.… on-chain Governor (/wiki/daos-governance/concepts/fundamentals/dao-gov…you a finished, audited whole.

How Caper approaches this Zod…e (verified against contracts/src/caper_daologic/src/lib.rs). The vote tokens are soul…tive as the right to be heard.

Category Execution · Safe (/wiki/daos/tooling/treasury/safe) modules · module standa…n a Safe (/wiki/daos/tooling/treasury/safe) from a plain multisig i…ted Safe (/wiki/daos/tooling/treasury/safe) · Snapshot (/wiki/daos/tooling/voting/snapshot) · Exit rights (/wiki/daos/concepts/membership/rage-quit-and-exit-rights) · …/tooling/dao-tooling-overview)

Zodiac is the missing piece be… Snapshot (/wiki/daos/tooling/voting/snapshot) — gasless, off-chai…n a Safe (/wiki/daos/tooling/treasury/safe) multisig that only a ha…isig the keys to the treasury.

The Avatar / Module / Modifier… (a Safe (/wiki/daos/tooling/treasury/safe) is the canonical avatar…y Aragon (/wiki/daos/tooling/frameworks/aragon) — is the whole thesis.

Reality Module (SafeSnap): exe… Snapshot (/wiki/daos/tooling/voting/snapshot) vote move an on-cha…timistic Governor (/wiki/daos/organizations/infrastructure/uma) , does the same job against UMA (/wiki/daos/organizations/infrastructure/uma) 's optimistic oracle instead of Reality.eth.

The rest of the kit: Delay, Ro…lising MolochDAO (/wiki/daos/organizations/public-goods/molochdao) 's rageQuit() into … to exit (/wiki/daos/concepts/membership/rage-quit-and-exit-rights) : d…ithdrawal rather than by vote.

Where it sits in the stack Zo… Snapshot (/wiki/daos/tooling/voting/snapshot) ), the custody layer ( Safe (/wiki/daos/tooling/treasury/safe) ), and the binding on-ch… / Cactus (/wiki/daos/tooling/voting/tally) front. Its appeal to l…Governor (/wiki/daos/concepts/fundamentals/dao-governance-models) for ev…you a finished, audited whole.

Category Execution · Safe (/wiki/daos/tooling/safe) modules · modu…s that turn a Safe (/wiki/daos/tooling/safe) from a plain m…o/) Related Safe (/wiki/daos/tooling/safe) · Snapshot (/wiki/daos/tooling/snapshot) · Exit rights (/wiki/daos/concepts/rage-quit-and-exit-r…) · Tooling stack (/wiki/daos/tooling/dao-tooling-overview)

Zodiac is the missing piece be… polls on Snapshot (/wiki/daos/tooling/snapshot) — gasless,…ney sits in a Safe (/wiki/daos/tooling/safe) multisig that …isig the keys to the treasury.

The Avatar / Module / Modifier…ansactions (a Safe (/wiki/daos/tooling/safe) is the canonic… like early Aragon (/wiki/daos/tooling/aragon) — is the whole thesis.

Reality Module (SafeSnap): exe…off-chain Snapshot (/wiki/daos/tooling/snapshot) vote move …le, the Optimistic Governor (https://docs.uma.xyz/developers/osnap/wiki/daos/uma) , does the same job against UMA (/wiki/daos/uma) 's optimistic oracle instead of Reality.eth.

The rest of the kit: Delay, Ro…ralising MolochDAO (/wiki/dao/ecosystems/molochdao) 's rageQuit() into…er's right to exit (/wiki/daos/concepts/rage-quit-and-exit-r…ithdrawal rather than by vote.

Where it sits in the stack Zo… DAO tooling stack (/wiki/daos/tooling/dao-tooling-overview)…ng layer ( Snapshot (/wiki/daos/tooling/snapshot) ), the custody layer ( Safe (/wiki/daos/tooling/safe) ), and the bind…ike Tally / Cactus (/wiki/daos/tooling/tally) front. Its ap… on-chain Governor (/wiki/daos/concepts/dao-governance-model…you a finished, audited whole.

Reality Module (SafeSnap): exe… Optimistic Governor (https://github.com/gnosisguilddocs.uma.xyz/developers/osnap) , does the same job ag…oracle instead of Reality.eth.

References - Gnosis Guild, Z…tation (https://docs.snapshot.org/user-guidesbox/v1-interface/plugins/safesnap-reality) . …tic Governor (oSnap) (https://github.com/gnosisguilddocs.uma.xyz/developers/osnap) . - Gnosis Guild, zo…co (https://www.zodiac.eco/) .

Category Execution · Safe (/wiki/dao/tooling/safe) modules · module standard Built by Gnosis Guild (https://www.gnosisguild.org/) (2022); open standard, LGPL-3.0+ What it is A library of composable contracts that turn a Safe (/wiki/dao/tooling/safe) from a plain multisig into a programmable, DAO-governed account Architecture Avatar · Module · Modifier · Guard — each an interface, freely composable Key modules Reality Module (SafeSnap) · Optimistic Governor · Delay · Roles · Exit Source github.com/gnosisguild/zodiac (https://github.com/gnosisguild/zodiac) · zodiac.eco (https://www.zodiac.eco/) Related Safe (/wiki/dao/tooling/safe) · Snapshot (/wiki/dao/tooling/snapshot) · Exit rights (/wiki/dao/concepts/rage-quit-and-exit-rights) · Tooling stack (/wiki/dao/tooling/dao-tooling-overview)

Zodiac is the missing piece between how most DAOs vote and how they act. A community runs its polls on Snapshot (/wiki/dao/tooling/snapshot) — gasless, off-chain, and non-binding — while its money sits in a Safe (/wiki/dao/tooling/safe) multisig that only a handful of signers can move. Between the two is a gap: something has to take a passed vote and actually execute the transaction, and for years that "something" was a small human multisig trusted to faithfully carry out the community's decision. Zodiac, an open contract standard built by Gnosis Guild (https://www.gnosisguild.org/) and first released in 2022, is the toolkit that closes that gap — letting a Safe execute the outcome of a vote directly, on trust-minimised rails, without handing a multisig the keys to the treasury.

The Avatar / Module / Modifier / Guard standard Zodiac's power is that it is a standard, not a single product. Per the Zodiac specification (https://github.com/gnosisguild/zodiac/blob/master/README.md) , it defines four composable roles around a programmable account: - Avatar — the account that holds the assets and executes transactions (a Safe (/wiki/dao/tooling/safe) is the canonical avatar). It implements the IAvatar interface, whose execTransactionFromModule function is how everything else moves it. - Module — a contract the avatar enables that carries decision-making logic and can tell the avatar what to execute. A DAO can enable several at once. - Modifier — a contract that sits between a module and the avatar and alters the module's behaviour — for example forcing a mandatory time delay on everything the module tries to do. A modifier looks like an avatar to the module above it, so modules and modifiers chain. - Guard — a contract enabled on a module that runs pre- and post-checks on each transaction, constraining what it is allowed to do. Because each role is just an interface, the pieces snap together like an expansion pack: you can chain a Delay modifier behind a Reality module behind a Safe, and the Safe neither knows nor cares which combination it is. That composability — rather than the monolithic, all-or-nothing design of a full framework like early Aragon (/wiki/dao/tooling/aragon) — is the whole thesis.

Reality Module (SafeSnap): executing a Snapshot vote The flagship module — originally shipped as SafeSnap and now the Reality Module (https://github.com/gnosisguild/zodiac-module-reality) — is what lets an off-chain Snapshot (/wiki/dao/tooling/snapshot) vote move an on-chain treasury. When a community drafts a Snapshot proposal, it can attach an array of transaction payloads to be executed if the vote passes. The outcome is then posted as a question to the Reality.eth (https://reality.eth.limo/) optimistic oracle: anyone can assert "this proposal passed," a bond backs the assertion, and unless someone bonds a counter-claim within a challenge window, the result finalises. Disputes can escalate to Kleros (https://kleros.io/) arbitration. Once the answer resolves and a cooldown elapses, the transactions become executable by anyone through the Safe — the multisig is out of the loop entirely. The oracle, not a trusted signer, is what asserts the off-chain vote's result on-chain, which is why this pattern is called optimistic governance. A sibling module, the Optimistic Governor (https://github.com/gnosisguild/osnap) , does the same job against UMA's optimistic oracle instead of Reality.eth.

The rest of the kit: Delay, Roles, and Exit The other modules address the everyday failure modes of running an on-chain organisation: - Delay Modifier — enforces a mandatory cooldown between when a transaction is proposed and when it can execute, giving members a window to react (or exit) before anything moves. It turns any module into a timelocked one. - Roles Modifier — grants scoped permissions, so a module or address can be allowed to call only specific functions on specific contracts (e.g. "this contributor may stake treasury assets in Aave but may not withdraw them"). It is the least-privilege layer for delegated treasury operations. - Exit Module — lets any holder of a designated token redeem it at any time for a proportional share of the avatar's assets, generalising MolochDAO (/wiki/dao/ecosystem/molochdao) 's rageQuit() into a bolt-on any Safe can install ( zodiac-module-exit (https://github.com/gnosisguild/zodiac-module-exit) , Exit App launched April 2022). It is the clearest on-chain expression of a member's right to exit (/wiki/dao/concepts/rage-quit-and-exit-rights) : dissent by withdrawal rather than by vote.

Where it sits in the stack Zodiac occupies the execution and permissioning layer of the DAO tooling stack (/wiki/dao/tooling/dao-tooling-overview) — the connective tissue between the voting layer ( Snapshot (/wiki/dao/tooling/snapshot) ), the custody layer ( Safe (/wiki/dao/tooling/safe) ), and the binding on-chain governance that tools like Tally / Cactus (/wiki/dao/tooling/tally) front. Its appeal to large DAOs is that it lets them keep cheap, high-participation off-chain voting and get trust-minimised execution, without adopting a heavyweight on-chain Governor (/wiki/dao/concepts/dao-governance-models) for every decision. The trade-off is assembly: a Zodiac-based DAO is a set of modules a team wires together and must configure correctly, and a misconfigured module or oracle is its own attack surface — the price of composability is that no single vendor hands you a finished, audited whole.

How Caper approaches this Zodiac exists because, in the mainstream stack, voting, custody, execution and exit are separate contracts a DAO must bolt together — and each seam is a place where a multisig, an oracle, or a misconfiguration can sit between the members and their treasury. Caper (/wiki/foundations/what-is-a-caper) takes the opposite route: those layers are one contract. A caper's proposals (/wiki/governance/proposals) , votes (/wiki/governance/voting) and execution (/wiki/governance/execution) are native to the protocol, so there is no SafeSnap-style bridge to trust — a passed proposal is the authorisation to execute. The contrast is sharpest at the Exit Module. Zodiac's exit is an optional add-on that returns a share strictly proportional to a redeemable token's balance. In Caper, exit is not a module you choose to install — every member holds it by construction, and the share is weighted by the same earned metric that sets voting power. A member redeeming caper tokens t together with their soulbound votes v receives a treasury fraction of (t · v) / (V · T) — the identical compute_vote_weight formula used when they vote (verified against contracts/src/caper_dao.rs). The vote tokens are soulbound and non-transferable, so exit weight is earned participation, not just a token you can buy on the way out. The right to leave with your fair share isn't a feature a caper's founders remembered to enable — it's the same primitive as the right to be heard.

References - Gnosis Guild, Zodiac — composable tooling for onchain entities (https://github.com/gnosisguild/zodiac) (standard & README). - Gnosis Guild, Reality Module (https://github.com/gnosisguild/zodiac-module-reality) and Exit Module (https://github.com/gnosisguild/zodiac-module-exit) repositories. - Snapshot, SafeSnap / Reality plugin documentation (https://docs.snapshot.org/user-guides/plugins/safesnap-reality) . - Reality.eth, optimistic oracle (https://reality.eth.limo/) ; UMA, Optimistic Governor (oSnap) (https://github.com/gnosisguild/osnap) . - Gnosis Guild, zodiac.eco (https://www.zodiac.eco/) .