Provide a concise narrative that clearly states each of (a)–(e) below.
Decentraland is a community-driven virtual space founded in 2015 and publicly launched in 2020, supported by the non-profit Decentraland Foundation and governed by its users. Users claim virtual space with LAND or Worlds and build venues, games, art, and experiences that they own.
(Source: About Decentraland)
The Decentraland Foundation builds and maintains the software that runs Decentraland, contributes to the platform codebase, maintains smart contract security, protects the community from scams and misinformation, and stewards the Decentraland brand. The DAO treasury funds community initiatives, events, and development. DCL Regenesis Labs operates as the DAO execution arm, a legal entity that hires globally, signs contracts, manages assets, and coordinates long-term projects without compromising the DAO structure.
(Source: About Decentraland, DCL Regenesis Labs)
Decentraland combines blockchain ownership, decentralized content delivery, and service infrastructure. LAND parcels exist as NFTs indexed onchain. Catalyst nodes serve content and coordinate peer-to-peer connections across the network. Files are content-addressed and identified by IPFS CID, and they remain immutable once deployed. The Marketplace trades Wearables, Emotes, LAND, and NAMEs.
(Source: About Decentraland, Catalyst Network, Marketplace)
MANA is the ERC-20 token deployed on Ethereum at 0x0f5d2fb29fb7d3cfee444a200298f468908cc942. The combined balance of MANA, LAND, and NAMEs held in a wallet determines voting power in the DAO. Ethereum MANA purchases LAND, NAMEs, and some special Wearables, and Polygon MANA purchases most Wearables and Emotes. Marketplace transactions carry a 2.5% MANA fee that transfers to the DAO treasury.
(Source: MANA Token on Etherscan, Marketplace, What is the DAO, The DAO Fund)
The DAO owns and controls the LAND and Estate contracts, the Marketplace fee contracts, the avatar NAMEs contracts, the banned-names list, the Points of Interest list, the Catalyst node list, the wearables collection contracts, and the grant vesting contracts. Changes to these surfaces require DAO approval and are enacted onchain by the DAO Committee or the Security Advisory Board. The DAO does not own and cannot modify the MANA contract, and no contract or wallet holds permissions to modify or pause the MANA supply.
(Source: What smart contracts does the DAO control, What is the DAO)
For each existing entity: Labs/DevCo (e.g., Founder, CEO, CTO, COO), Foundation (e.g., President, Executive Director, CFO, COO), and DAO / onchain governance leadership (if applicable) list the: (a) full names, (b) official titles, (c) and prior experience of key team members. For any non-existent entity, explicitly mention it does not exist. External links may be included but they will not factor into the score.
Full Name | Entity | Official Title | Prior Experience |
|---|---|---|---|
Ari Meilich | Labs | Project Lead and Chief Executive Officer through April 2020 | Earned a neuroscience degree from Hunter College and conducted research at NYU, Brown, and Mount Sinai, worked as a market research analyst at venture firm CRV in 2015, and cofounded the IT consultancy Benchrise in 2016 before cofounding Decentraland in 2017. |
Esteban Ordano | Labs | Tech Lead and Chief Technology Officer, whitepaper coauthor | Studied software engineering at ITBA and worked at Google and then at BitPay from 2014, where he built the open-source Bitcore library and the Copay Bitcoin wallet. |
Manuel Araoz | Labs | Founder and whitepaper coauthor | Cofounded the smart-contract security firm OpenZeppelin and created Proof of Existence, and built the earliest Decentraland prototypes. |
Yemel Jardi | Labs | Founder and whitepaper coauthor | A blockchain engineer who later led the Decentraland Foundation as Executive Director. |
Agustin Ferreira | Foundation | Foundation Executive Director from 2020 through mid-2023 | Held product, technology, legal, and community roles at Decentraland and served on the Security Advisory Board, with earlier experience at Ethereum Buenos Aires, Xivis, and the South American Business Forum. |
Yemel Jardi | Foundation | Foundation Executive Director | A Decentraland cofounder and whitepaper coauthor with a blockchain engineering background who led the Foundation as Executive Director. |
Kim Currier | Foundation | Marketing Lead, Head of Partnerships and Marketing | Holds a marketing degree and a masters in marketing analytics from Bentley University, spent most of her career at advertising agencies, and has worked in Web3 since 2021. |
Manuel Araoz | DAO | DAO Council member | Decentraland founder and whitepaper coauthor, cofounder of OpenZeppelin, and creator of Proof of Existence. |
Agustin Ferreira | DAO | DAO Council member | Former Foundation Executive Director with product, technology, legal, and community experience at Decentraland. |
@metaryuk | DAO | DAO Council member | A longtime Decentraland community member and former Ambassador who holds LAND, NAME, and MANA and has served as a tester and advocate. |
@canessa | DAO | DAO Council member | No prior professional experience is publicly disclosed beyond participation in Decentraland community governance. |
@fehz | DAO | DAO Council member | No prior professional experience is publicly disclosed beyond participation in Decentraland community governance. |
@ginoct (Gino) | DAO | Executive Director of the Executive Arm, elected by the DAO Council | No prior professional experience is publicly disclosed beyond his elected role leading the Decentraland DAO Executive Arm. |
Blockworks note: Decentraland was built and governed across three groups of people. The launch-era development team authored the whitepaper and shipped the platform. The Decentraland Foundation team runs the nonprofit that holds the intellectual property. The DAO Council and Executive Arm run onchain governance and operations. Each roster below reflects publicly documented individuals only. |
Provide a structured description of the DAO's governance, powers, and economic rights. If a DAO does not exist, state so. Address the lettered items below. Even if there is no DAO, there must be an answer to (d).
The Decentraland Foundation holds the intellectual property over the Decentraland tools, website, trademarks, and repositories. The Terms of Use state that the Foundation does not own or control Decentraland, which is decentralized and governed by the community through the DAO. The Foundation is a non-profit independent entity that holds the platform IP for the benefit of the community.
(Source: Terms of Use, About Decentraland)
The DAO is the decision-making tool for MANA, NAMEs, and LAND holders. Through governance proposals the community issues grants and changes the lists of banned names, Points of Interest, Catalyst nodes, and the DAO-owned contracts. Only holders of MANA, NAMEs, and LAND vote and create proposals, and voting power is weighted by the combined wrapped and unwrapped balances associated with the wallet at proposal creation. Approved binding proposals are stored via Snapshot on IPFS and enacted on Ethereum by the DAO Committee through a multisig wallet overseen by the Security Advisory Board. The DAO owns the LAND and Estate contracts, the NAMEs contracts, the banned-names list, the Points of Interest list, the Catalyst node list, the wearables collection contracts, the Marketplace fee contracts, and the grant vesting contracts. The Establishing an Executive Arm proposal keeps DAO control over governance, treasury, and project smart contracts while the Executive Arm manages operations under DAO Council oversight, with the Security Advisory Board continuing to safeguard the contracts and treasury. A related proposal migrated execution duties to a 3-of-5 multisig that includes at least two DAO Council members among its signers, identified the Regenesis and Council multisig as 0x93AcCD5b8AEE795C6efcfdEDFE4a292e59e00e84, and requested the transfer of 23,716,538 MANA or the DAI equivalent from the DAO Treasury to that multisig.
(Source: What is the DAO, How does the DAO work, What smart contracts does the DAO control, Establishing an Executive Arm, DAO Committee Deprecation and Replacement)
Decentraland does not require or offer token locking or staking. DAO voting power derives from the combined wrapped and unwrapped balances of MANA, NAMEs, and LAND held in a wallet, and holders do not need to lock or unwrap tokens to exercise their full voting power.
(Source: What is the DAO, How does the DAO work)
The DAO holds a 10-year vesting contract worth 222,000,000 MANA that started on February 19, 2020 and vests every second. A 2.5% Marketplace fee on primary-market commissions transfers to the DAO. The OpenSea Marketplace charges a 2.5% fee on sales of LAND, Estates, Names, and wearables, part of which transfers to the DAO.
(Source: The DAO Fund)
Decentraland has not publicly disclosed dissolution authority over the DAO or the Foundation.
For the Primary Foundation do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist. Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
The primary foundation is the Decentraland Foundation, a Panama Private Interest Foundation established in 2020 that operates as an independent nonprofit supporting Decentraland. A WIPO Arbitration and Mediation Center panel decision recorded the Foundation as a Panama-based complainant that operates the Decentraland platform at decentraland.org and provides blockchain-powered virtual world products and services under the DECENTRALAND name.
The Foundation's mandate is to hold the intellectual property that supports the platform and to support its development for the benefit of the Decentraland community. The Foundation is the registered proprietor of United States Trademark Registration No. 5,682,061 for DECENTRALAND, which registered on February 19, 2019 with a first-use date of January 2017 across international classes 9, 38, and 41. That registration was originally held by Metaverse Holdings Ltd and was later assigned to the Foundation, a transfer that the WIPO panel confirmed on the evidence before it.
Under the Decentraland Terms of Use, the Foundation holds the intellectual property rights over the DCL Client, the Desktop Client, the SDK, the Marketplace, the Builder, the Blog, Events, Agora, the Forum, the Land Manager, the Command Line Interface, the DAO interface, the Developers' Hub, the Rewards tool, and other features that the Foundation makes available over time, which the Terms collectively call the Tools. All ownership and intellectual property rights over content that users create, including wearables and other NFTs, remain with the users who created that content rather than with the Foundation or the DAO.
The Foundation's role is operational rather than governing. It operates and maintains the official Decentraland clients and tools and acts as the delegated operator responsible for client development and maintenance, while governance authority over the protocol, the treasury, and reward parameters sits with the community through the DAO. The 222,000,000 MANA ten-year vesting contract that began on February 19, 2020 directs tokens to the Decentraland DAO treasury rather than to the Foundation.
No public primary source records a Foundation power to direct DAO governance outcomes, execute treasury actions, administer the MANA token contract, or set reward parameters, and no method or threshold for any such power is attributed to the Foundation.
The Foundation does not exercise decision-making authority over either the launch-era development company or the current execution arm. Metaverse Holdings Ltd is a launch-era entity that assigned the DECENTRALAND trademark to the Foundation and is not identified in any public source as currently active in Decentraland development. Protocol development and operations today run through the Decentraland DAO and its execution arm, DCL Regenesis Labs, whose Director is hired, guided, and if necessary replaced by the DAO Council, with the annual strategy and budget subject to veto by the DAO. The Foundation holds no seat in that structure, and no public primary source records Foundation influence, direct or indirect, over the decision-making of either entity.
No public primary source records the Foundation holding pause, upgrade, or governance-executor authority over the MANA token contract or over Decentraland's onchain governance contracts, and no multisig configuration, veto right, or voting threshold is attributed to the Foundation. Decentraland's DAO treasuries are locked behind a multi-signature scheme controlled through DAO governance rather than by the Foundation.
The only documented programmatic flow of protocol-controlled resources is the 222,000,000 MANA ten-year vesting contract that began on February 19, 2020, which directs tokens to the Decentraland DAO treasury rather than to the Foundation. No governance-approved, contractual, or programmatic mechanism directing treasury assets, fees, revenue, rewards, or token distributions to the Foundation, its contributors, or other participants is recorded in a public primary source, and the Foundation's own funding arrangement is not detailed in a public primary source.
Blockworks note: (Source: WIPO Decision D2022-0294, Decentraland Terms of Use, The DAO Fund, Decentraland Documentation)
For the Primary DevCo do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist. Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
The launch-era development company is Metaverse Holdings Ltd, a Cayman Islands limited company that developed Decentraland during its 2017 launch era. The WIPO panel decision identifies Metaverse Holdings Ltd as a Cayman Islands company and records that it originally held the DECENTRALAND trademark before assigning it to the Decentraland Foundation.
Protocol development and operations today run through the Decentraland DAO and its execution arm, DCL Regenesis Labs. Regenesis Labs is incorporated as a foundation in the Cayman Islands, a status confirmed in its August 2025 status update, and it operates under a Cayman Islands foundation structure that acts as a legal wrapper.
(Source: WIPO Decision D2022-0294)
Metaverse Holdings Ltd originally held United States Trademark Registration No. 5,682,061 for DECENTRALAND and later assigned that registration to the Decentraland Foundation, a transfer the WIPO panel confirmed on the evidence before it. Metaverse Holdings Ltd does not currently own or control Decentraland repositories, code, or brand assets, and no subsidiary entities of Metaverse Holdings Ltd are identified in public sources.
DCL Regenesis Labs operates as a Cayman Islands foundation acting as a legal wrapper for DAO execution and does not hold Decentraland trademarks or platform intellectual property, which sit with the Decentraland Foundation.
DCL Regenesis Labs manages DAO funds and operational budgets through a separate Regenesis Labs Treasury and a distinct Operational Wallet. The Cayman Islands foundation legal wrapper means Regenesis Labs does not hold direct access to the DAO treasury funds. To centralize budgeting and treasury management, the DAO approved transferring 23,716,538 MANA and DAI from the DAO treasury to the execution arm, which gave Regenesis Labs the funds it needs to execute community decisions.
Regenesis Labs also runs a grants program to fund delivery. Season 1 of the Regenesis Grants Program offers grants of up to US$15,000 paid in MANA, a delivery window of up to 90 days, and milestone-based payments for open-source projects.
Regenesis Labs holds no authority over MANA token administration, including minting, burning, or contract ownership, and does not set reward parameters unilaterally; it executes decisions made by the DAO. Payment-approval processes and control mechanisms governing its disbursements fall within the scope of the independent audit the DAO approved for 2025 and 2026.
Neither Metaverse Holdings Ltd nor DCL Regenesis Labs exerts direct or indirect influence over decision-making at the Decentraland Foundation. The structures are separate: the Foundation holds the platform intellectual property and operates the official clients and tools, while Regenesis Labs executes DAO decisions under the direction of the DAO Council. Metaverse Holdings Ltd assigned its DECENTRALAND trademark to the Foundation and retains no recorded governance or control relationship with it.
Governance of the execution structure sits with the DAO Council and the DAO. The Council hires, guides, and if necessary replaces the Director of the Executive Arm, and the annual strategy and budget that the Director proposes remain subject to veto by the DAO.
Neither Metaverse Holdings Ltd nor DCL Regenesis Labs holds pause, upgrade, or governance-executor authority over the MANA token contract. Public governance documentation describes the Council's replacement power and the DAO's veto qualitatively and does not specify the multisig configuration or the voting threshold applied to either.
The DAO approved transferring 23,716,538 MANA and DAI from the DAO treasury to DCL Regenesis Labs for budgeting and treasury management. Regenesis Labs disburses funds through the Regenesis Grants Program, which pays up to US$15,000 in MANA per grant on a milestone basis over a delivery window of up to 90 days.
Because Regenesis Labs manages DAO funds, the DAO approved an independent audit of Regenesis Labs for 2025 and 2026. The audit scope covers the legal and structural review of how Regenesis Labs was formed and disburses funds, vendor and contractor payments, equipment purchases, quarterly expenses, wallet activity across the Operational Wallet and Regenesis Wallet, payment-approval processes and control mechanisms, governance, and grant expenditures.
Historically, in October 2018 Animoca Brands announced a collaboration agreement with Metaverse Holdings Ltd to co-develop two blockchain-based games for the Decentraland platform. The two companies agreed a mutual investment of US$500,000, with Animoca Brands investing in shares in exchange for the equivalent value in Decentraland MANA tokens, and the swapped shares and tokens were held subject to an escrow period.
Blockworks note: The Animoca Brands share-for-MANA swap is also relevant to Q10 (Prior Token Sales & Fundraising).
(Source: WIPO Decision D2022-0294, Animoca Brands partners with Decentraland, Smallcaps coverage of the Animoca collaboration, August Status Update, DCL Regenesis Labs, Introducing DCL Regenesis Labs, Establishing an Executive Arm to improve DAO Operations, June Status Update, DCL Regenesis Labs, Regenesis Grants Program Season 1 Now Open, Independent Audit Proposal for Regenesis Labs 2025-2026)
Disclose launch and initial supply details in a single initial allocation schedule covering the token's launch.
Decentraland did not issue a fixed launch supply. The token launch began at block 4170700, approximately August 17, 2017, under sale terms published July 3, 2017. Because the sale was priced per block on a rising scale and capped by contribution value rather than token count, the number of tokens issued at launch was determined by contribution volume. The sale ended when total contributions reached the US$25 million cap, or at day 9, for a maximum span of 8 days. Total supply currently stands at approximately 2,193,179,327 MANA.
40% to crowdsale buyers, who purchased MANA directly during the block-priced sale; 20% to community incentives; 20% to the development team, early contributors and advisors, as compensation subject to vesting; and 20% retained by Decentraland. The Decentraland Token Sale Terms define these four buckets by category label and do not attach a further per-bucket use-of-funds description.
The initial price per 1,000 MANA (equal to 1 LAND) was US$24 and increased with each consecutive block throughout the sale. Price discovery was therefore mechanical rather than fixed: the offering price rose block by block from the US$24 starting level until the contribution cap or the 8-day window was reached.
Decentraland (MANA), ERC-20 at 0x0f5d2fb29fb7d3cfee444a200298f468908cc942, 18 decimals.
Supply is not fixed. MANA supply increases 8% in the first year and at a lower rate in subsequent years under a Continuous Token Model. Etherscan and CoinGecko show a total supply of approximately 2,193,179,327 MANA.
The Sale Terms specify vesting for project lead tokens only: three years with a six-month cliff, with one-sixth of the tokens maturing semi-annually. No vesting, lockup, or staged release is specified for the crowdsale, community incentives, advisor, or Decentraland-retained buckets, which were not subject to a published release schedule.
Blockworks note: Launch date, sale cap, and sale duration are carried in the Launch Supply Totals cell because the form's six columns provide no dedicated field for them.
(Source: The Decentraland Token Sale Terms, Everything You Need to Know About the Decentraland Token Launch, Etherscan MANA Token, CoinGecko Decentraland)
Address each of the following sub-items based on the project's airdrop status. If a sub-item does not apply to the project's situation, state that explicitly.
Planned but not yet executed airdrop: Not applicable. Decentraland has no planned or forthcoming MANA airdrop, so no commitment to publish a recipient wallet list, target user segments, or allocation method applies.
Executed airdrop: Not applicable. Decentraland has not conducted an official MANA airdrop, so there is no per-address allocation source, covered user segment, or allocation method to disclose.
No airdrop planned or conducted: Decentraland has never conducted an official MANA airdrop and does not plan to execute one. Decentraland's security documentation states that websites, social accounts, emails, and direct messages impersonating Decentraland and advertising a free airdrop of MANA are among the most common scams, and that a free MANA airdrop is something Decentraland will never do.
(Source: Decentraland Security FAQ)
Blockworks note: (Source: Decentraland Rewards Program Terms, Decentraland Earning Rewards Docs)
Projects must disclose all material terms of market-making arrangements that affect token liquidity. If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. For each market maker, include in a table:
If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. If no native tokens were loaned or allocated to market makers, state that explicitly; cash/fiat retainers or fees are not required for this item.
Blockworks note: No market-maker agreement between Decentraland, the Decentraland DAO, or the Decentraland Foundation and a named third-party market maker is publicly disclosed. Public records instead show two distinct things. The first is a set of DAO-directed liquidity and incentive actions decided through onchain governance to seed or reward liquidity in specific MANA pools. The second is market-maker programs that the exchanges themselves operate, which are open to any qualifying liquidity provider and are not specific to MANA. Decentraland does not publish any contract, token allocation, or loan-and-option arrangement with a designated market maker.
The verifiable MakerDAO relationship is that MANA was added as a Maker collateral type through a Maker executive vote that concluded on July 28, 2020, which lets holders lock MANA to mint DAI. This is a collateral onboarding, not a MANA-DAI liquidity provisioning deal.
Projects must disclose all material terms of centralized or decentralized exchange listings that affect token liquidity. For each listing, include in a table:
If the project has no agreements or deals with CEX or DEX, state that explicitly; doing so earns full credit; cash/fiat fee amounts are not required for this item.
Blockworks note: Decentraland does not publicly disclose any exchange listing agreement that commits a MANA token allocation or fixed term to a centralized exchange. The listings below are exchange-initiated and the DEX liquidity rows are DAO-funded. Listing fees follow each exchange's published policy.
(Source: Coinbase MANA listing, Kraken MANA listing, SEC press release)
Disclose all prior token sales by the Project — including fundraising rounds, any material OTC sales to investors, and any discounted market-maker sales. For each sale, provide:
If no prior sales occurred, state that explicitly (e.g., "No prior fundraising, OTC, or discounted MM sales have occurred.").
Blockworks note: (Source: The Decentraland Token Sale Terms, Animoca Brands Partnership and Mutual Investment with 6 Leading Blockchain Companies, Smallcaps Animoca Brands Blockchain Gaming)
The MANA sale was structured in two stages, a Crowdsale Event followed by a Continuous Token Sale. The Crowdsale began on block 4170700 around August 17, 2017, ran for a maximum of 8 days, and ended when total contributions reached the $25 million USD cap or when the launch reached day 9. The launch used an increasing price model in which the first day represented a 40 percent discount relative to the final day price and the price rose at an average rate of about 5 percent per day. Decentraland disclosed that proceeds would be allocated 50 percent to development, 10 percent to research, 15 percent to marketing and community development, and 20 percent to operations and business development. CoinDesk reported that the launch raised 86,206 ETH, worth approximately US$26,203,082 at the time, and Animoca Brands later stated that Decentraland raised US$26 million in the August 2017 MANA sale and that Decentraland investors included Digital Currency Group, Kenetic Capital, FBG, CoinFund, and Hashed.
(Source: Everything You Need to Know About the Decentraland Token Launch, Intended Allocation of Proceeds, CoinDesk Decentraland Raises $26 Million in ICO, Animoca Brands Partnership and Mutual Investment with 6 Leading Blockchain Companies)
If any, list prior exploits or incidents that directly affected the token, token supply, tokenholder balances, token contract, minting controls, burn mechanics, or custody of token supply. This question is not asking about general protocol, application, or smart contract exploits unless the incident directly affected the native token itself. If no prior incidents, state this explicitly (e.g., "No exploits affecting tokenholders or protocol funds as of YYYY-MM-DD").
Incident 1 — 2023-01-15
Ethereum; DAO Committee signer key, held within a compromised private-key backup. Custody-adjacent; DAO multisig treasuries unaffected.
Incident 2 — 2017
Ethereum; MANA token contract and ContinuousCrowdsale.sol, identified in pre-deployment audit by Zeppelin Solutions (now OpenZeppelin Security). Not exploited.
Incident 1
A backup containing private keys was compromised, including the key used by the DAO Committee. The attacker transferred and liquidated the personal assets held in that individual account on decentralized exchanges.
Incident 2
The audit identified two severe issues in the MANA token contract. First, the owner could finalize the crowdsale before it had ended, because the modified version removed the precondition requiring that the crowdsale had ended, leaving the sale vulnerable to premature closing by the owner. Second, an unchecked math operation in ContinuousCrowdsale.sol could overflow.
Incident 1
No loss of community treasury funds. All DAO treasuries are locked behind a multi-signature scheme, so the compromise of a single Committee key did not expose treasury assets. Losses were confined to personal assets held in the affected individual account, an amount Decentraland has not disclosed publicly.
Incident 2
No loss of funds. Both issues were identified in audit and remediated in code before they could be exploited.
Incident 1
The Security Advisory Board replaced the compromised key until the account holder could restore secure access.
Incident 2
The premature-finalization issue was fixed in a later commit, and the unchecked-math issue was fixed in a separate later commit.
Incident 1
Resolved. Key rotated, no treasury loss, no litigation or ongoing investigation disclosed.
Incident 2
Resolved. Both findings remediated in code prior to launch.
No exploit has affected the MANA token contract, token supply, minting controls, burn mechanics, or tokenholder balances as of 2026-08-10.
(Source: RCA Temp Atlas Server DoS 2025-01-07, RCA AWS Key Exposed 2025-02-27, RCA Cookie Poisoning 2025-05-23, RCA WAF Cache Poisoning 2025-05-26, RCA XSS Through State Parameter 2025-08-25, RCA RTMP Password Exposure 2025-09-29, RCA GitHub Actions Script Injection 2025-10-23, RCA Newsletter Authorization 2026-03-04, RCA Avatar and Login Failure 2026-03-04, RCA Wallet Login Availability March 2026, RCA Events API Ownership 2026-04-07, Decentraland smart-contract-audits, Decentraland Bug Bounty on Immunefi, DAO Committee Incident Security Disclosure, OpenZeppelin Decentraland MANA Token Audit, Decentraland RCA Repository, RCA Marketplace Expired Listing 2023-07-31, RCA Marketplace Search 2023-10-03, RCA Archipelago signedFetch 2024-10-08)
Blockworks note: Decentraland maintains a public root cause analysis repository that functions as a shared knowledge base of incident and vulnerability post-mortems, with content published only once each incident is mitigated or resolved so that potential vulnerabilities are not exposed. None of the documented incidents affected the MANA token contract or resulted in treasury loss, and they therefore fall outside the scope of this question. Documented incidents span Marketplace listing and search failures (July and October 2023), an Archipelago handshake signing issue (October 2024), an Atlas server denial-of-service and an exposed production AWS key (January and February 2025), two Cloudflare web application firewall issues (May 2025), a cross-site scripting issue in the auth-api login endpoint (August 2025), an RTMP streaming password exposure reported through Immunefi (September 2025), a GitHub Actions script-injection issue in creator-hub (October 2025), a Builder API newsletter authorization issue and an auth-site identity corruption incident (both March 4, 2026), a wallet login availability failure caused by a stale container-image digest (March 2026), and an Events API ownership-check ordering issue (April 2026).
Decentraland also maintains a public smart-contract-audits repository containing third-party audit reports for its onchain contracts, including LAND, Estate, Marketplace, Offchain Marketplace, Bids, Names, Collections, Rentals, and Periodic Token Vesting. Security research is further incentivized through the Decentraland bug bounty program on Immunefi, which offers a maximum bounty of US$500,000 for critical smart-contract vulnerabilities and pays rewards in MANA and USDT on Ethereum denominated in USD.
Describe material risk factors across the three categories below. Each category includes prompts to address at a minimum.
(a) Regulatory, Legal & Tax Risks — Describe how evolving laws and regulations could affect the project by answering, at a minimum, questions like:
Impact of Regulatory Change on TGE and Listings: (If applicable) How could evolving or conflicting laws and regulations affect your ability to complete the TGE, deliver tokens to purchasers, and list or maintain the token on trading venues in key jurisdictions?
Entity-Level Regulatory Impact: (If applicable) How could regulatory or legal changes impact your core entities (Foundation, DevCo, DAO, affiliated service providers), including enforcement actions, licensing requirements, or forced changes to structure or operations?
Tokenholder Tax Treatment: (If applicable) What uncertainties exist around how tokenholders may be taxed, and make clear that tokenholders are responsible for understanding their own tax obligations?
Jurisdictional & User Access Restrictions: (If applicable) If the project restricts access for certain jurisdictions or user types (e.g., U.S. persons, sanctioned countries, retail vs. professional), what are those restrictions and what risks do they create for users and for the project?
(b) Protocol, Technology & Security Risks — Describe risks to network and contract reliability, correctness, and safety by answering, at a minimum, questions like:
Bugs and Design Flaws: (If applicable) What bugs, design flaws, or implementation errors could exist in your core protocol code, smart contracts, and any bridges, rollups, or oracles that you depend on, and how could these lead to loss of funds or disruption of the protocol?
Security Measures & Their Limitations: (If applicable) What security measures have you taken (audits, formal verification, bug bounties), and what types of failures might these measures still fail to detect or prevent?
(c) Token Economics, Unlocks & Incentive Risks — Describe how the token's economic design and supply schedule could affect holders by answering, at a minimum, questions like:
Critical Economic Assumptions: (If applicable) Which economic assumptions (e.g., staking yields, fee revenue, liquidity incentives, MEV capture, demand for blockspace) are critical for protocol security, utility, and governance, and what happens if those assumptions fail?
Governance Control over Monetary Policy & Rewards: (If applicable) To what extent can governance change monetary policy, fee parameters, or reward allocations (e.g., inflation rate, treasury flows, incentive programs), and how could such changes adversely affect tokenholders?
The Decentraland Terms of Use state that the Foundation, MANA, LAND, and ETH could be impacted by one or more regulatory inquiries or regulatory action in one or more jurisdictions, which could impede or limit the ability of users to access or use the Tools or the Ethereum blockchain. Users represent that they are legally permitted to use the Tools, including owning tokens, and remain responsible for their own compliance with applicable law. Users are solely responsible for any taxes arising from their acquisition, possession, or use of tokens and from LAND-related and other transactions, and must comply with the applicable tax obligations in their jurisdiction. Users who reside in a jurisdiction where online gambling is banned, such as the United States, China, and South Korea, must refrain from accessing content that includes online gambling.
(Source: Decentraland Terms of Use)
The Terms of Use provide the Tools and the Site on an as-is and as-available basis without warranties of any kind, note that they may contain defects and bugs, and state that they must not be relied on for correct or secure functionality. Users access the Tools through third-party private-key managers, and neither the DAO nor the Foundation is responsible for account-security breaches or for loss arising from a shared or lost private key or unauthorized access to an account. The Terms further warn that advances in code cracking or technical advances such as the development of quantum computers may present risks to smart contracts, cryptocurrencies, and the Tools, which could result in the theft or loss of tokens.
(Source: Decentraland Terms of Use)
The onchain trading infrastructure reflects these controls. The offchain marketplace contract supports EIP-712 signed trades across Ethereum and Polygon, with configurable execution counts, start and expiration times, addresses permitted to execute a trade, external checks on other smart contracts, and fee deduction routed to a beneficiary. ADR-289 defines the Explorer Client signed fetch, which places scene metadata such as scene identity, parcel location, and realm information into the signed payload and ensures that scene code running within the client cannot access, modify, or forge those metadata headers, the payload hash, or the signer. The two severe issues found in the 2017 OpenZeppelin audit of the MANA token contract were fixed in later commits.
(Source: Offchain Marketplace Contract, ADR-289 Explorer Client Scenes Signed Fetch, OpenZeppelin MANA Token Audit)
Decentraland publishes a root cause analysis repository once incidents are mitigated. It documents the 2025 critical web vulnerabilities that include an exposed production AWS key, the Admin Tools RTMP password exposure, the auth-state XSS, and the GitHub Actions script injection, the 2025 low-severity issues that include the temporary Atlas server denial of service, cookie poisoning, and WAF cache poisoning, and the 2026 incidents and vulnerabilities that include the auth-site identity and login failure, the newsletter endpoint authorization gap, the wallet-auth login availability outage, and the Events API ownership issue. Reports submitted through the Decentraland program on Immunefi require a proof of concept for web, application, and smart-contract findings and require KYC for reward recipients, with payouts made by the Decentraland team in MANA and USDT.
(Source: Decentraland RCA Repository, Decentraland Bug Bounty on Immunefi)
MANA, Ether, and other blockchain-based digital assets are highly volatile, and their value can be affected by popularity, adoption, speculation, regulation, technology, and security. The DAO was granted a 10-year vesting contract worth 222,000,000 MANA that started on February 19, 2020 and vests every second, adding roughly 1.8 million MANA to the fund each month. To mitigate this volatility and avoid selling MANA when liquidity is low, the DAO has run governance proposals to convert a portion of its MANA treasury into stablecoins, including a proposal to convert one fifth of the treasury into equal proportions of USDC, USDT, and DAI to diversify and stabilize the treasury.
(Source: Decentraland Terms of Use, The DAO Fund, DAO Proposal to Convert MANA to Stablecoin)
The DAO established an Executive Arm under the oversight of a DAO Council and approved the transfer of DAO Treasury funds, including 23,716,538 MANA and DAI, to a Council-controlled multisig operated through DCL Regenesis Labs to enable operational execution. As of March 31, 2026 the Operational Wallet held 1,044,984.04 MANA and the DCL Regenesis Labs wallet held 12,180,517.00 MANA. Token-sale proceeds were intended to be allocated 50 percent to development, 20 percent to operations and business development, 15 percent to marketing and community development, and 10 percent to research. The MANA continuous token sale price can be modified by the DAO, and that selling price can only be changed with the consensus of multiple Decentraland Board signatories.
(Source: Establishing an Executive Arm to Improve DAO Operations, March Status Update DCL Regenesis Labs, Intended Allocation of Proceeds, Building a LAND Economy with the MANA Token)
This Token Transparency Filing is provided for general informational purposes only and does not verify or warrant the accuracy of individual answers.
