The number is 91%.
Thirty treasury withdrawal proposals on Cardano have committed 457.4 million ADA against an allowance of 500 million. That leaves roughly 42.6 million ADA of headroom in the current budget window. No exploit. No reorg. No admin key turned in the dark. No peg to defend.
Every one of those thirty proposals was drafted, debated, voted, ratified, and executed under the Conway-era rules that Cardano spent the better part of a decade constructing. The machine performed exactly as specified. Then the machine ran out of room.
That is the part worth sitting with. We have spent ten years teaching ourselves to fear the failure modes of broken code — the reentrancy bug, the mispriced feed, the compromised multisig, the upgrade that bricks a bridge. We have built entire security industries around those fears, and rightly so. What we have not built is a vocabulary for the failure mode where the code is flawless, the votes are legitimate, the audits are clean, and the parameters are simply wrong.
This is not a hack story. It is a budget story. And in a bear market, budget stories are the ones that decide which ecosystems are still standing eighteen months from now.
I want to be careful and honest about my sources here. What I am working from is a short industry brief — thin granularity, no timestamps, no proposal identifiers, no cycle boundaries, no live ADA price. That means a meaningful share of what follows is inference from the Cardano governance framework itself rather than transcription from the brief. I will label the confidence on every load-bearing claim. That is not hedging. That is the whole method. Trust no one. Verify everything.
Context: what Cardano actually built, and why it matters that it worked
To understand why a spending cap is more interesting than a price candle, you have to understand what Cardano shipped before it shipped this problem.
Cardano's governance transition arrived in two stages. The Chang hard fork in September 2024 activated the on-chain governance primitives; the Plomin hard fork in January 2025 handed actual control of the treasury and protocol parameters to the three bodies that CIP-1694 defines. Before that, Cardano's decentralization was, in the honest reading, a narrative held up by a federation of stake pool operators and a founding entity with a lot of influence. After it, the treasury became a real thing that real votes could move.
Those three bodies are the architecture you need in your head:
DReps — Delegated Representatives. ADA holders delegate voting weight to representatives, who vote on governance actions. This is liquid delegation, not a fixed parliament. Delegation can be re-pointed at any epoch boundary. In theory this makes representatives accountable on a short leash. In practice, as I will argue, it makes them campaigners.
The Constitutional Committee. A body that checks governance actions against a constitution — the guardrail against procedurally valid but substantively illegitimate moves. It can rule an action unconstitutional. This is the most under-discussed chokepoint in the entire design.
Stake Pool Operators. Voting on protocol parameters and certain hard-fork matters, retaining a narrower but still consequential role.
The treasury itself is funded by three flows: a slice of monetary expansion as the reserve releases over time, a share of transaction fees, and refunds — returned deposits from proposals that did not proceed, unconsumed allocations, and similar reversions.
The brief states one sentence that carries almost all of the analytical weight: new inflows and refunds do not replenish the withdrawal allowance. Read that twice. It is the difference between two entirely different systems.
If inflows replenished the allowance, the constraint would be a balance-sheet constraint — you can spend what you have, and what comes in adds back to what you can spend. That is how a checking account works.
If inflows do not replenish the allowance, the constraint is a gross commitment cap over a defined window. You can commit up to a ceiling per period, regardless of how much arrives during that period. That is how a corporate capital expenditure budget works.
The brief uses the word "allowance," not "balance." That is a deliberate word. My reading, at medium confidence, is that this maps onto Cardano's Net Change Limit (NCL) — an on-chain parameter, set through a governance action, that fixes the maximum net treasury outflow for a given period. Once ratified, the number is the number. The treasury can be enormous and the budget can still be exhausted. Those are not the same fact, and conflating them is the most common error I expect to see in coverage of this story.
For scale: Cardano's maximum supply is 45 billion ADA. The treasury has historically held in the billions. A 500 million ADA spending allowance is not the treasury running dry. It is the treasury's checkbook for this period running dry. Solvency is untouched. Funding liquidity is what broke.
I spent 2017 auditing whitepapers during the ICO mania — fifteen early Ethereum-based protocols, one of them Gnosis, where I spent three weeks mapping the oracle dependency graph and concluded the prediction market's decentralization claims were load-bearing on a component nobody had stress-tested. That experience taught me a permanent habit: when a system tells you it is decentralized, find the parameter that a small group can turn. Parameters are where sovereignty hides. They always have been.
Core: the analysis
Funding liquidity is not solvency, and the difference is where the damage lives
In financial engineering we separate two things that sound identical to outsiders: a firm that cannot pay its obligations, and a firm that cannot fund its commitments on the timeline its commitments require. The first is death. The second is a run — and runs kill healthy institutions all the time.
Cardano just experienced the second. The protocol can pay. It cannot commit new money this period. And the mechanism that produced that state has no built-in reversion, because the brief tells us inflows and refunds do not restore the allowance.
The precise technical characterization is this: Cardano's treasury mechanism has a hard gross commitment cap with no intra-period elasticity. It is a circuit breaker with no reset button inside the window.
That design has an obvious virtue and an obvious cost. The virtue is discipline: you cannot spend your way around a budget by pointing at incoming revenue. The cost is congestion: when demand for grants exceeds the ceiling, the ceiling does not ration demand — it queues it, and queues change behavior.
The number the brief doesn't give you — and it's the one that matters
Thirty proposals consumed 91% of the allowance. Most coverage will stop there, because 91% is a satisfying number.
It is also nearly useless on its own.
What I need is the temporal distribution of those thirty proposals. Not the count. Not the total. The timing.
Two worlds produce the same 91%:
World A — normal demand. Thirty proposals spread across the budget window, each ratified on its merits, aggregate demand simply exceeded the ceiling. Diagnosis: the ceiling was set too low for the ecosystem's actual appetite. Fix: raise it, calibrate for next period.
World B — a run. The first handful of proposals consume a visible share, the community reads the remaining headroom, and every sophisticated actor rationally accelerates their own submission to grab budget before it vanishes. The last twenty proposals land in a compressed window, several of them under-specified, because the marginal value of filing now exceeds the marginal value of filing well. Diagnosis: the mechanism's incentive structure rewards speed over quality. Fix: this is much harder, and raising the ceiling makes it worse.
Both worlds end at 91%. They demand opposite responses. The brief does not give me the timestamps. So I will not tell you which world we are in. I will tell you that anyone who tells you confidently is guessing.
What I can say, at medium confidence, is that World B is structurally available here. A fixed pool, first-come-first-served access, no replenishment, and full public visibility of the remaining balance is the exact recipe for a bank run. Depositors run on banks not because the bank is insolvent but because they believe other depositors will run first. Here, grantees accelerate not because the treasury is empty but because they believe other grantees will take the allowance first. Same psychology. Different instrument. Nobody's deposit is at risk, but the commons is.
This is the mechanism I would flag to any protocol designing a treasury: if the remaining budget is public and the access rule is first-come, you have built a run.
A hard cap plus open access plus no replenishment equals a commons with a clock on it
There is a second-order effect that will shape Cardano's next two quarters, and it is distributional rather than financial.
When 91% is gone, the remaining 42.6 million ADA becomes the most contested number in the ecosystem. At any plausible price in this cycle, that is a sum in the low tens of millions of dollars — enough for a handful of serious infrastructure grants, nowhere near enough to fund a season of ecosystem stimulus. It will not be allocated by merit alone. It will be allocated by whoever can draft, lobby, and ratify fastest.
That favors a specific profile: teams with governance experience, existing DRep relationships, professional proposal-writing capacity, and the patience to shepherd a withdrawal action through the Constitutional Committee. It disadvantages exactly the population that ecosystem funding is supposed to reach — the two-person team building an indexer, the researcher who needs six months of runway, the maintainer nobody has heard of.
I watched this movie in 2021. I organized Soulbound Berlin — forty artists and technologists, twelve non-transferable tokens, an explicit attempt to prove that on-chain identity could exist without financialization. Within weeks, roughly 90% of participants had found a way to extract a price from something designed to be priceless. The lesson I took was not that people are greedy. It was that incentive structures override stated intentions with near-perfect reliability, and the designers always think their community is the exception. Cardano's proposal queue is not exempt from that law.
Governance has an oracle problem, and nobody is pricing it
Here is where I want to bring in something from my DeFi work, because the analogy is exact and I have not seen it drawn.
DeFi's structural weakness is feed latency — the gap between the state of the world and the state the protocol believes. A lending market that prices collateral on a stale feed is not mispriced by accident; it is mispriced by architecture. I have argued for years that the industry's fixation on decentralizing the node set of an oracle while ignoring the latency of its answers is a category error dressed up as rigor.
Governance has the identical pathology, one layer up.
A DRep votes on a proposal whose actual quality — did the team deliver, did the grant produce a public good, did the milestone mean anything — is only observable quarters later. There is no feed for delivery. There is no attestation for ROI. The vote is priced on the proposal document and the proposer's reputation, which is to say it is priced on promises, and promises are the least reliable input in any market I have ever analyzed.
This is the real reason a budget cap binds early. It is not that demand is infinite. It is that the signal DReps act on arrives systematically earlier than the signal that would tell them whether they were right. Adverse selection is not a risk in this system. It is the default.
In 2020, during DeFi Summer, I worked with three MakerDAO core developers on a governance simulation for MKR. We modeled voting behavior against delegation concentration and whale participation. The result that stayed with me was not that whales could dominate — everyone suspected that. It was that whales dominated most efficiently precisely when proposal quality was hardest to assess. Where outcomes were measurable and near-term, distributed voting tracked quality reasonably well. Where outcomes were diffuse and long-horizon, delegation collapsed into a handful of recognizable names, and those names became the de facto budget committee.
Cardano's thirty withdrawals are exactly the diffuse, long-horizon case. I would want to see DRep concentration metrics before I believed the allocation reflected ecosystem need rather than ecosystem access.
What the three-body design buys, and what it charges
CIP-1694's DRep / Constitutional Committee / SPO split is genuinely one of the more thoughtful governance designs in production. It separates legitimacy (DReps), legality (the Committee), and operational reality (SPOs). It is more textured than a token-weighted referendum and considerably more textured than the off-chain foundation-and-forum model that most large ecosystems actually run on.
It also charges a price, and the price is exactly what we are looking at.
Every additional check adds a place for an action to stall. A withdrawal must satisfy DRep majorities, survive constitutional review, and — depending on category — clear SPO thresholds. That is three sequential gates. Three gates mean three failure points and three sources of delay. In a period of abundant headroom, delay is invisible. In a period where the remaining budget is 9%, delay is the entire story.
There is a sharper observation buried here. The Constitutional Committee is a partially centralized node in an otherwise distributed system. It cannot initiate spending, but it can block it. That is veto power, and veto power is a form of sovereignty that risk frameworks routinely underweight because it does not look like a multisig. If the Committee's interpretation of the constitution constrains how budget mechanics can be adjusted — for instance, whether a mid-period NCL increase is constitutionally permissible — then seven-ish people become the effective arbiters of ecosystem funding. That is not a criticism of their integrity. It is a structural observation, and structural observations are what you want before you need them.
I flagged this exact pattern in my 2017 Gnosis writeup. The oracle dependency was not a bug; it was a designed dependency that everyone had agreed not to think about because thinking about it would have complicated the pitch. Cardano's Committee dependency is cleaner, more transparent, and more defensible. It is still a dependency.
The comparison that flatters Cardano least
Cardano's governance is often benchmarked against Polkadot's OpenGov and Tezos's self-amending ledger. The comparison is instructive, and not entirely kind.
Polkadot's OpenGov splits the treasury across multiple tracks with separate approval and support curves, precisely so that one category of spending cannot starve another. It is a deliberately fragmented budget by design, which means congestion in one track does not become congestion in all tracks. Cardano's single net-change ceiling is simpler and more legible, and it produces exactly the failure mode simplicity predicts: one ceiling, one queue, one bottleneck.
Tezos has run on-chain governance longest, with a self-amendment mechanism that lets the protocol change its own rules through the same process that changes its code. That is slow — painfully slow — but it is elastic. The rules can be revised by the mechanism itself. Cardano can also revise its NCL through a governance action, at medium confidence, but the brief's silence on any reset or revision path suggests the revision is not automatic and not fast.
Ethereum, meanwhile, has no on-chain treasury budget at all. Its funding flows through a foundation, ecosystem funds, and a thick layer of venture capital. Nobody can exhaust Ethereum's grant capacity because nobody agrees on what Ethereum's grant capacity is. That is messier and less accountable, and it is also structurally immune to the specific failure Cardano just hit.
And I would be a hypocrite not to name the parallel to my own long-standing complaint about Layer 2s. We now have dozens of rollups, each with its own grants program, its own incentives budget, its own foundation — and a user base that has not grown commensurately. That is not scaling. That is slicing already-scarce liquidity into ever-thinner fragments and calling the fragmentation a feature. Grant fragmentation follows the same logic. Many pools, one ecosystem, no shared accounting. Cardano at least has a single ledger of what it spent. Most ecosystems cannot say that.
Where the money went, and the disclosure gap that outranks the cap
Here is the finding I consider most important, and it is an absence rather than a fact.
The brief contains no delivery data for the 457.4 million ADA already committed. No milestone completion rates. No ROI disclosures. No public accounting of which of the thirty proposals produced anything a user touched.
I want to be precise about why this outranks the cap in importance. A binding budget with measured outcomes is a functioning institution. A binding budget without measured outcomes is a spending program with a ceiling, and the ceiling is doing all the work that judgment was supposed to do.
If the thirty withdrawals were largely well-spent, then the cap is a calibration error and the fix is arithmetic — raise the NCL, move on. If a meaningful share were low-quality, repetitive, or delivered nothing, then hitting the cap is not a failure at all. It is the only quality control the system currently has, and it is accidental.
I cannot resolve that question from the brief. Neither can you. But I can tell you what to look for, and it is not the price chart.
A verification checklist I would actually run, in order:
Pull the thirty treasury withdrawal governance actions from the chain. Sort them by submission epoch, not by ratification date — the submission clustering is the World A / World B discriminator. Map each to a delivering entity. Check whether any entity appears more than once; repeat recipients are the signature of an access advantage rather than a merit advantage. Pull the DRep vote distribution on each action and compute concentration; if a small set of DReps supplied the deciding margin on most of the thirty, the budget was allocated by a committee that nobody elected as a committee. Read the Constitutional Committee's published reasoning on any withdrawal it reviewed closely, because that reasoning is where the de facto constitutional law of the treasury is being written. And check whether any of the 42.6 million ADA of remaining headroom has been committed since the brief was written, because the last 9% is where the next story is.
That is maybe four hours of work for someone with the tooling. It would settle most of what this article has to infer. The fact that it has not been done publicly, at scale, for a budget of this size, tells you something about the maturity of the entire sector's governance journalism.
Contrarian: maybe the cap binding is the best thing that happened to Cardano this quarter
Now the part that will annoy people on both sides.
I do not think hitting the ceiling is straightforwardly bad. I think there is a real chance it is the mechanism working.
Consider what a cap is for. It exists because institutions that can spend without limit eventually do. Every credible governance system in history has needed a constraint that bites — not a constraint that gestures. The gold standard was called a barbaric relic for exactly the reason it was useful: it made governments feel the cost of their decisions in real time, and it was hated for it. Gold is heavy. Code is light. But a cap that never binds is not light code — it is decoration.
Cardano's cap bound. In public. On-chain. With thirty votes on the record. That is not an embarrassment. That is a system demonstrating that its constraint is load-bearing rather than ornamental.
There is a sharper version of this argument, and it cuts against the ecosystem's own marketing. Cardano's differentiator was never that its governance produces better outcomes. It is that its governance failures are legible. When Cardano misallocates, you can see it — action by action, vote by vote, address by address. When a foundation misallocates, you get a blog post. When a venture-backed ecosystem misallocates, you get nothing at all, because the money was never on a public ledger to begin with. A system whose failures are auditable is a system that can improve. A system whose failures are invisible is a system that can only compound them.
I would trade a legible bottleneck for an illegible one every time.
There is also a defensible reading of the no-replenishment rule that I want to put on the table at low confidence, because I have not seen it argued and it may be correct. If inflows replenished the allowance, the treasury would function as a revolving credit facility. Grantees would learn to time submissions to monetary expansion events. The budget would become procyclical — easiest to access precisely when the protocol was already distributing. A fixed gross ceiling, blind to inflows, prevents that reflexivity. It forces the ecosystem to decide in advance what the period is worth, and then live with the decision. That is a harder discipline than a balance-sheet model, and it may be the intentional one.
So where does the contrarian argument fail? It fails at the point where discipline is confused with judgment.
A cap is a limit on quantity. It says nothing about quality. Hitting the cap proves the ecosystem wanted to spend; it proves nothing about whether spending was wise. If the 457.4 million ADA went to thirty proposals with no published delivery data, then the cap did not impose discipline — it imposed arithmetic, which is the cheapest possible substitute for governance and the easiest one to mistake for it.
And the argument fails a second time on the question of repair speed. A healthy institution hits a constraint and revises it. The brief's silence on any automatic reset or fast revision path is the detail I find most concerning, at medium confidence. If raising the ceiling requires the same three-gate process that produced the congestion, then the ecosystem's recovery time is a function of its own friction — and the friction is the thing that caused the problem. That is a loop, not a mechanism.
Summer fades. Builders remain. But builders remain only where the runway does, and runway in this ecosystem runs through a budget that is now 91% spoken for.
Takeaway
Strip away the noise and here is what actually happened: a protocol built one of the most sophisticated on-chain governance systems in existence, handed it a fixed budget with no intra-period elasticity, watched thirty legitimate proposals consume 91% of it, and discovered that its constraint had no fast release valve.
The treasury is not empty. The checkbook is. And the distance between those two facts is where the entire next chapter lives.
The near-term question is arithmetic and will be resolved in weeks: does a governance action to revise the net change limit clear DReps and the Constitutional Committee, and does the Committee's constitutional reading permit a mid-period adjustment at all? Watch the Committee's published reasoning more closely than the vote count. That reasoning is the precedent, and precedent outlives budgets.
The medium-term question is structural and will be resolved in quarters: does Cardano respond to a rigid cap by adding elasticity — dynamic limits, category tracks, a genuine emergency path — or does it respond by simply raising the number and waiting for the same congestion at a higher ceiling? The first is institutional learning. The second is a treadmill.
The question I actually care about is the third one, and it is the one nobody is asking: when a mature on-chain polity meets its first binding constraint, does it measure, or does it spend?
Because that choice, not the 91%, is what the next ecosystem will copy.
Noise is cheap. Signal is rare. The signal here is not that Cardano ran out of budget. It is that for the first time, we can watch a decentralized treasury hit a wall in public, with every vote on the record, and find out whether the people holding the levers reach for a spreadsheet or a bigger lever.
I will be reading the timestamps. You should too.
