Paper 2026/1773

Enforcing Winner-Only Disclosure: Verifiable Tally Hiding for Weighted DAO Governance

Abstract

Token-weighted governance can fingerprint individual voters: when weights are unequal and externally known, the exact weighted tally may reveal who voted which way. Publishing only the winning outcome hides the tally from the public, but a system that reconstructs the tally in order to decide still hands it to whoever runs the computation. Publishing only the winner is not the same as computing only the winner. We present a verifiable protocol for weighted DAO votes in which no protocol role ever receives the weighted tally in plaintext. Each ballot proves in zero knowledge that its encrypted contribution is exactly zero or the voter’s registered weight. Trustees add accepted contributions and compare the sum with a threshold entirely under encryption using the Cortier–Gaudry–Yang (CGY) conditional-gate toolbox, and decrypt only the final decision. A public verifier checks that the computation consumed exactly the ciphertexts accepted by the governance contract. We prove accepted-result correctness even when all trustees are malicious; restricted-I/O SUC security of the tally against static active corruption of any sub-threshold trustee coalition, which is any four of five in our reference instance; and winner-only disclosure relative to the real sealed board. With 1,024 voters, the encrypted tally takes 157 s and independent replay 115 s, while ballot proving dominates the 28.5-minute end-to-end pipeline. A fresh Arbitrum Sepolia execution exercises the complete public-chain path

Note: V4 substantially strengthens the security model and proof architecture: the reference threshold is upgraded from 3-of-5 to 5-of-5, giving tally security against up to four statically active trustees; the proof now inherits the applicable CGY restricted-I/O SUC composition result; and the previous Honest-Cast restriction is replaced by a real-admission/sealed-board disclosure formulation allowing malicious voters during board formation. The implementation is updated with a native Rust tally/replay backend and a fresh 5-of-5 Arbitrum Sepolia execution.