# Control-Cost Derivation: What a Controlling Voting Block Costs
*Probity Institute — method note. Descriptive only: no rating change, no recommendation, no statement about any token's price or prospects.*
A GSA verdict states whether a governance right is enforced in code. It does not state what it costs to acquire enough voting power to decide an outcome. Those are different questions, and the second one is the one a risk reviewer actually asks about a governance token: if the right can be exercised, at what price does someone exercise it against the people holding the token?
This note describes the release at `/data/determinations/exercisability.json`, which answers that question for each token in the 53-token universe, or states plainly why it cannot be answered today.
## Coverage, stated first
- **Priced:** 24 of 53 tokens carry a derived control cost.
- **Infeasible:** 1 token (Frax) requires more than its entire supply.
- **No purchasable surface:** 8 tokens have no token-holder voting surface at all to price.
- **Insufficient evidence:** 20 tokens have a voting surface, and the release names exactly which input is missing or unusable.
The 2026-10-01 cycle priced ten of these tokens. This release recomputes those ten from fresh inputs and prices fourteen more. The gap it closes is coverage, not method.
## What the formula does
The arithmetic is unchanged from the 2026-10-01 release. It is reproduced here so a reader can recompute every figure.
1. **The required block.** `flip_vp = max(quorum_floor, t/(1-t) x expected_opposition)`
- `quorum_floor` is the gate in force: a fixed token amount, a share of supply, or a share of staked supply at a 0.60 staking ratio.
- `expected_opposition = max(P90 turnout, 2 x median turnout) x mobilisation`, where the mobilisation multiplier is **2.0** and turnout is the *largest single-choice* vote power in each of the space's recent proposals. `scores_total` is deliberately not used: it sums vote power across choices and overstates participation.
- `t/(1-t)` is 1.0 at a simple-majority threshold. A second chamber doubles the block.
2. **The cost.** `flip_vp x price x ve_multiplier x slippage`
- `ve_multiplier` is **4.0** where voting requires locking the token for years, and 1.0 otherwise.
- `slippage = 1 + 0.1 x sqrt(block_usd / advisory_liquidity)`, where advisory liquidity is the registry's curated estimate where one exists, otherwise **observed 24-hour volume**. A bribe path, where a per-vote price with a primary source exists, is priced and the cheaper path wins. No new row in this release uses a bribe path.
3. **Infeasible** when the required block exceeds 100% of total supply.
## The pricing gate
A row is priced only when all three hold:
- a purchasable voting surface exists (not a validator-set chain, not a dissolved or paused DAO);
- no blocker is recorded against it — a venue that is not the one that binds, voting power that is not the tradable balance, a quorum that cannot be read;
- the turnout series holds at least **10 proposals** and its newest is within **365 days**.
A token already priced in the 2026-10-01 release is never withdrawn by the gate: it is recomputed and its published value is carried beside the new one.
## Every row is typed, so a blank is never ambiguous
| Status | Meaning |
|---|---|
| `priced` | A control block is derived from the published inputs. |
| `infeasible` | The required block exceeds the entire supply. |
| `no_purchasable_surface` | No token-holder voting surface exists to price. |
| `insufficient_evidence` | A surface exists; a required input is missing or unusable, and `blocker_type` names which. |
The blocker vocabulary is published in the release: `no_token_venue`, `wrong_venue`, `no_live_venue`, `unit_mismatch`, `missing_input`, `thin_series`, `unobservable_series`, `two_regimes`, `no_flat_quorum`.
This matters more than the coverage number. A bare null in a numeric field is unusable: a consumer cannot tell "not derived yet" from "not purchasable at any price". Twenty-nine rows in this release carry a typed reason instead.
## Reading the numbers
The figure is the cost of assembling the block the formula says is required, at last traded price with a slippage term. It is not an offer, not a realised transaction, and not a statement about prospects.
Four things inflate a figure, and each is flagged per row:
- **Mobilisation.** A 2x multiplier sits on top of a P90 turnout term, so a contested history raises the required block.
- **Slippage.** The square-root term is a heuristic. Above roughly ten times observed daily volume it dominates the result and the figure should be read as an upper bound. Rows where it does are flagged `slippage_out_of_range` — six in this release.
- **Locked capital.** ve-stack rows carry the 4x multiplier, so their figures are not comparable with spot-token rows without that context.
- **Above market capitalisation.** Where the required block costs more than buying every token at spot, the row is flagged `cost_exceeds_market_cap` — four in this release.
And two things are deliberately not modelled: borrowed or delegated voting power, and any defence that is not a second chamber. Guardian and council vetoes are recorded per row as caveats; they do not enter the arithmetic.
## Worked example: Aave
Every input, and the result:
- **Surface.** Aave Governance v3 on Ethereum binds; the `aavedao.eth` Snapshot space is the ARFC signal stage. The row records that the turnout series comes from a signal space.
- **Quorum.** 320,000 AAVE yes-votes at the short-executor level.
- **Turnout series.** 14 proposals, largest single-choice vote power: median 372,452, P90 415,813.
- **Required block.** `max(320,000, 1.0 x max(415,813, 745,904) x 2.0) = 1,489,808 AAVE`, or 9.3% of supply.
- **Cost.** `1,489,808 x $149.43 x 1.10 = $244.7M`, or 10.6% of market capitalisation.
- **Caveat recorded:** the Aave Guardian holds an emergency cancellation role.
## Reproducing a row
```bash
curl -s https://probity-institute.pages.dev/data/determinations/exercisability.json \
| python3 -c "
import json,sys
d = json.load(sys.stdin)
print(d['summary'])
for r in d['rows']:
if r['status'] == 'priced':
print(r['slug'], r['derivation']['control_cost_usd'],
r['derivation']['control_cost_pct_mcap'], r['control_surface']['stack'])
"
```
Each row publishes the price, supply, quorum, turnout series, multipliers, advisory liquidity and its source, the caveats, and the evidence list — so the arithmetic above can be recomputed from the file alone. The inputs are also cached at a dated path (`data/registry/market-inputs-2026-10-23.json`) and the derivation can be rerun offline against it.
## What this release is not
It does not change a GSA verdict, a tier, or the frozen methodology. It is additive: the per-token records keep the 2026-10-01 cycle values, and this file states a dated derivation that merges into those records at the 2027-01-01 re-check. A control cost is not a score, a rating, or a view about anyone's intentions. Where the record admits two readings — a figure that is an upper bound, a venue that does not bind — both are published and neither is resolved.
---
*Determinations and derivations are CC-BY-4.0. Attribute to "Probity Institute GSA Determinations" and keep the derivation date attached: a figure without its date and inputs is a different figure.*
---