Linh, a product manager in Ho Chi Minh City, joined a DeFi DAO in late 2024 with 500 governance tokens and a clear goal: support a liquidity-mining proposal she believed would bring sustainable yield. On the forum, a large token holder opened a private chatroom: 200 USDC for every "yes" vote, no strings attached. A third of active voters accepted. The proposal passed with 78% support and allocated $2M treasury to a project with no deployed code and an anonymous team. Linh's carefully researched "no" vote was buried under a sea of purchased "yes." Dao bỏ phiếu bí mật — secret DAO voting backed by zero-knowledge proofs — closes this attack at the protocol level: a voter proves eligibility and submits a valid ballot while keeping the choice hidden, even from the coordinator tallying the votes.
The vote-buying epidemic in DAOs
Token-weighted voting was designed to align incentives: more tokens, more skin in the game, louder voice. In practice, it created a vote marketplace. Bribe marketplaces formalized governance vote purchases into on-chain yield offers. In 2023, community monitors estimated that 20-40% of votes in major DeFi DAOs were influenced by direct or indirect bribes — hidden revenue sharing, future airdrop promises, or consulting retainers. Vietnamese communities are not exempt: small-cap DAOs and airdrop-gated governance often see whale Telegram groups organizing coordinated vote buying around token distributions.
The damage is structural. A bought vote transfers treasury funds to the briber's preferred outcome — typically a yield farm or token emission that benefits large holders at retail's expense. The network only sees valid cryptographic signatures; it cannot distinguish conviction from commerce.
Why naive secrecy is not enough
Hiding the vote does not stop the bribe. A coordinator who sees only encrypted votes can still coerce the voter into revealing the plaintext off-chain before or after submission. Without an eligibility proof, a whale can also instruct accomplices to Sybil-vote, multiplying bribery impact. A simple encrypted ballot solves neither coercion resistance nor double-voting.
Zero-knowledge proofs solve both by binding the act of voting to something only the eligible voter possesses. The voter constructs a proof locally stating: "I held X tokens at block Y; I have not voted in this election; I am submitting a valid ballot choice Z." The network verifies the proof on-chain and records the vote without ever seeing the voter's identity or choice. The proof is the ballot.
Figure 1: The vote-buying attack — public token votes turn every ballot into a bribe receipt
How ZK enables verifiable secret voting
The design is a three-step protocol.
Step 1 — Eligibility proof. The voter's wallet reads an on-chain Merkle tree of eligible token holders at the snapshot block. The voter proves membership via a zero-knowledge circuit: their leaf index, their token balance, and a nullifier (a unique, unlinkable identifier derived from their address and the election ID). The proof is generated locally; only the public inputs — tree root, nullifier hash, election ID — go on-chain.
Step 2 — Encrypted ballot submission. The voter signs their encrypted vote choice and broadcasts it together with the eligibility proof. A smart contract verifies the proof against the public Merkle root and records the nullifier, preventing double-voting. Because the choice is encrypted and the proof reveals nothing about it, no observer can link the vote to the voter.
Step 3 — Coordinator decryption. A coordinator collects encrypted ballots, verifies all proofs, and only then decrypts the aggregate tally — typically via threshold multi-party computation (MPC) or a public decryption event. Until decryption, no single party knows the vote distribution. After decryption, only the totals are revealed.
This is exactly the architecture behind MACI (Minimal Anti-Collusion Infrastructure), an Ethereum Foundation project. In MACI, messages (votes and key-change operations) are posted to a smart contract. Users can post multiple encrypted votes under different nullifiers, but only the latest one counts. The coordinator decrypts the tally, and the decryption key is rotated via a public parade. Even a malicious coordinator cannot publish a fake decryption without detection by the verifier contract.
Figure 2: The ZK secret voting flow — eligibility proven before decryption, so bribery has no receipt to verify
What makes MACI different from a naive secret ballot
Naive secret ballots rely on trust: trust the administrator not to peek, trust the database not to leak, trust the tally process. MACI replaces trust with verifiable computation. The coordinator can cheat, but they cannot cheat undetected — the verifier contract checks the decryption against on-chain nullifiers and message hashes. Any discrepancy is publicly visible.
More importantly, MACI prevents vote buying even when the buyer demands proof. Because the voter can generate an unlimited number of nullifiers, a coercer cannot verify which vote was the "real" one. The voter shows the coercer any old message and nullifier, then posts the actual vote later under a fresh nullifier. Privacy is not just about hiding the vote; it is about making the vote non-binding against coercion.
Production examples and tradeoffs
MACI has been used in Ethereum Foundation grant rounds and Gitcoin's quadratic funding rounds with ZK identity verification. Polygon experimented with MACI-style voting for community governance trials. In EF's 2024 public goods funding round, roughly 12,000 voters participated via a ZK-weighted quadratic vote without revealing identity to round operators.
The tradeoffs are real. ZK proving adds per-vote latency: on a consumer laptop, a Groth16 proof takes 1-3 seconds and costs $0.02-0.10 in gas (or near zero on an L2). The coordinator is a trust point — a malicious coordinator can withhold decryption, though the verifier contract catches incorrect tallies. The biggest open problem is coercion resistance: sophisticated attackers can use hardware keyloggers or video surveillance to confirm the ballot before signing.
Figure 3: Public token vote vs ZK secret vote — the difference is who can read your ballot
What secret DAO voting means for Vietnamese crypto communities
Vietnam has Southeast Asia's highest retail crypto participation rate, but governance literacy lags. Many Vietnamese investors join Discord DAOs and airdrop-gated governance without understanding token-weighted vote concentration. Whale-organized Telegram vote buying is a documented pattern in small-cap projects. Secret ZK voting on a Polygon or BSC sidechain gives Vietnamese DAO operators an auditable, coercion-resistant governance layer without requiring every voter to understand Merkle trees.
Three practical steps for local DAOs. First, adopt quadratic or MACI-style voting for treasury decisions rather than pure one-token-one-vote. Second, encrypt the vote flow: use ZK circuits to prove eligibility and hide the choice. Third, publish the coordinator decryption key and verifier output so any member can independently reconstruct the tally. The result is a community that can verify election fairness without knowing how any individual voted.
Frequently asked questions
Does ZK secret voting make auditing impossible?
No. The network verifies the eligibility proof on-chain and records a nullifier preventing double voting. Anyone can count valid votes by running the verifier; what they cannot do is associate a vote with an individual voter. The election integrity is verifiable; the ballot secrecy is enforced by cryptography.Can a voter prove they voted a certain way to a coercer?
In MACI, the voter can generate an unlimited number of nullifiers during the voting window. Only the last one counts. The voter shows the coercer any old message and nullifier, then posts the real vote later under a fresh nullifier. Proof-of-vote coercion is impossible.Why not just use off-chain secret ballot?
Off-chain ballots require trusting the organizer not to peek, not to miscount, and not to leak the voter list. ZK on-chain voting requires trusting only the verifier contract and the coordinator's published decryption — which anyone can check.Is MACI only for Ethereum?
No. MACI's smart contract is EVM-compatible and has been deployed on Polygon, Optimism, and Arbitrum. The proving circuit is standalone; any chain that supports a verifier contract can run it.How expensive is voting with ZK?
On an L2 such as Polygon or Arbitrum, a Groth16 membership proof plus encrypted vote costs roughly $0.01–0.05 in L2 gas. Proving takes 1–3 seconds on a laptop. For treasury votes over $100K, this is negligible. For micro-decisions, off-chain signaling combined with on-chain execution keeps ZK reserved for major votes.What if the coordinator goes offline or disappears?
The coordinator publishes decryption parameters on-chain. If they fail to do so, the DAO can rotate to a new coordinator by executing a governance action. The on-chain nullifiers and message hashes preserve the ability to verify any correct decryption, so a new coordinator can re-tally without re-running the election.Conclusion
Linh's DAO failed because its voting rule made governance a marketplace. Token-weighted public voting hands the outcome to whoever can afford the most tokens — or the most bribes. Dao bỏ phiếu bí mật with zero-knowledge proofs removes the demand for vote buying: the vote is valid, the voter is eligible, but no one can see the choice. MACI and similar ZK voting systems turn governance from a bidding war into a verifiable tally, and the technology runs on production chains today. Vietnamese DAOs do not need to invent new primitives — they need to adopt them. Secret voting is not secrecy for its own sake; it is the only architecture that makes vote buying mathematically futile.
Quick Reference
| Property | Public Token Vote | ZK Secret Vote (MACI-style) |
|---|---|---|
| Vote visibility | Anyone — whale, bidder, analyst | Encrypted; eligible-vote proof only |
| Bribe market | Active — payment for on-chain proof | Blocked — no way to prove how you voted |
| Double voting | Possible with Sybil keys | Nullifier prevents re-vote |
| Tally verification | Anyone can count | Anyone can run the verifier; tally is checkable |
| Coercion resistance | Low — vote is public proof | High — unlimited nullifiers per voter |
| Per-vote cost | ~0 gas (sign and send) | ~$0.01–0.05 on L2, 1–3s proving |
| Coordinator trust | None (direct tally) | Limited — decryption params published on-chain |
| Production today | Every DAO | EF MACI rounds, Gitcoin QF, Polygon trials |
| Best fit | Low-value signaling | Treasury votes, membership decisions |