On 4 October 2026, Greenfield Capital filed an Aufsichtsanzeige with Switzerland’s Federal Supervisory Authority for Foundations, the ESA, concerning the Safe Ecosystem Foundation. The same day, founding partner Jascha Samadi published an open letter on the Safe community forum explaining why. Greenfield has backed Safe since the 2022 financing round that accompanied its spin-off from Gnosis, says it has never sold a single SAFE token, and says it holds its full position today.
Every report framed this as an investor fight. It is more interesting than that. Greenfield is a token holder in a DAO with a published constitution, a Snapshot space, delegated voting power and fifty-six proposals of history. Four years of governance machinery was available to it. It went to Bern instead.
That choice is the story, and the reason it is the story has nothing to do with who is right about Safe’s strategy.
TL;DR
- Greenfield Capital filed a supervisory notification with Switzerland’s ESA on 4 October 2026 over the governance of the Safe Ecosystem Foundation, after what it describes as a year of private engagement.
- Greenfield co-authored SEP 50, SafeDAO’s own oversight-committee proposal, in December 2024. It closed with 8,454,415 SAFE voted against the 10,000,000 quorum recorded on the safe.eth Snapshot space, short by 1,545,585. The two proposals that closed the same day both cleared it.
- SafeDAO’s live proposal, SEP 56, had 25 voters and 7,107,054 SAFE as of 5 October, with the vote closing on 6 October. The space has 17,729 followers. SEP 5, in March 2023, drew 2,107 voters.
- Article 84(3) of the Swiss Civil Code lists exactly who may appeal to a foundation’s supervisor: beneficiaries, creditors, the founder, donors, and current and former board members. Token holder is not on the list.
- Exactly one SafeDAO decision was self-executing. We read the deployed SAFE token contract: it has
unpause()and nopause()at all. That vote can never be undone by anyone. Every other vote was a request to a board. - A provable count proves the arithmetic. It does not prove the count entitles you to anything. Standing is not a number, and it is the half nobody weighs.
What was actually filed, and why the word matters
Greenfield’s letter is careful about this, and the wire coverage was not. What it filed is an Aufsichtsanzeige: a supervisory notification. In its own words, it is “the mechanism by which any party can inform the ESA … about potential irregularities in the governance or the management of a foundation under its supervision.”
Any party. That is the point, and it cuts in a direction nobody noticed. An Aufsichtsanzeige is open to anyone because it confers nothing on the person filing it. You report; the authority decides whether to look. You get no right to a decision, no right to be heard as a party, and no appeal if the authority shrugs.
There is a stronger instrument, and it is new. Since 1 January 2024, Article 84(3) of the Swiss Civil Code reads:
“Beneficiaries or creditors of the foundation, the founder, donors and current and former members of the foundation board who have an interest in ensuring that the administration of the foundation complies with the law and the foundation charter may appeal to the supervisory authority against acts or omissions of the foundation’s governing bodies.”
That provision was inserted by the federal act of 17 December 2021, titled, without irony, “Strengthening Switzerland as a Foundation Location”. Read the list again. Beneficiaries. Creditors. The founder. Donors. Current and former board members. A firm that bought into a financing round and holds a governance token is none of those five things in any obvious way. It is not a shareholder, because a Swiss foundation has no shareholders. It has no members at all. That is what a foundation is: a pot of assets with a purpose and a board, answerable to a supervisor rather than to owners.
So the strongest available lever is one where Greenfield’s four-year, never-sold, full-size position counts for precisely nothing, and the lever it could definitely reach is one where nobody’s position counts for anything, because it grants no standing to anyone. Article 84(2) tells you who the supervisor actually answers to: it “must ensure that the foundation’s assets are used for their declared purpose.” The purpose. Not the holders.
The remedy has teeth. It is just not yours to pull.
None of this means the supervisor is toothless. The opposite. Article 85 of the same code provides that, at the request of the supervisory authority and having heard the board, the competent federal or cantonal authority may modify the foundation’s organisation where that is urgently required to preserve its assets or safeguard its objects. Article 86b lets the supervisor make minor charter amendments on its own motion. In the extreme, a non-functioning foundation can be wound up.
Read the italics. The power to restructure a Swiss foundation’s organisation is real, and it is exercised on the supervisor’s application, not the complainant’s. Greenfield cannot ask for that remedy. It can only hope somebody in Bern decides to.
And there is something concrete for Bern to look at, which is the most underrated fact in the letter. Greenfield says the Foundation’s deed requires a minimum of three board members, and that between September 2025 and April 2026 it had two. That is not a strategy disagreement. That is a charter term, and Article 84(2) makes charter compliance the supervisor’s explicit job.
What the Foundation did next is the part that will decide this. On Greenfield’s account, in March 2026 it invited backers to nominate candidates under three models, ranging from an advisory board through guest participation to full board membership, then in June established a “Strategy Commission”: appointed by the board, reporting to the board, with no decision-making authority over the board. Of three options, the one that changes the least. The vacancy itself was filled with Richard Meissner, a Safe co-founder and former Gnosis employee who co-ran the company that built and operated Safe{Wallet} on the Foundation’s behalf.
Whether that is a breach or merely unimpressive is a question for Swiss administrative law, and we are not going to pretend to answer it. The structural point stands either way: the only person who can escalate it is the person with no obligation to.
The on-chain route was tried. It missed quorum.
Here is the part that no coverage mentioned, and it is sitting in public on Snapshot.
In December 2024, Greenfield co-authored SEP 50 with Avantgarde Finance: “Establishing a DAO Oversight Committee to bring Strategy, Process & Accountability to Treasury Management to the SafeDAO”. A three-member steering committee, an RFP process for treasury managers, published goals. Oversight, proposed through the DAO, by the people now filing in Switzerland.
It drew 4,885,218 SAFE for Accept, 2,200,290 for Make No Changes and 1,368,907 abstaining. Total votes cast: 8,454,415, against the 10,000,000 quorum recorded on the safe.eth space. Short by 1,545,585 SAFE, on 171 voters.
Two other proposals closed on the same day, 23 December 2024. SEP 51 cleared with 12,181,691. SEP 52 cleared with 15,270,178. The oversight proposal is the one that did not make it. Greenfield’s open letter mentions authoring SEP 50 and is conspicuously silent about what happened to it.
Now look at what the governance surface has done since. SEP 54, in July 2025, was a “temporary pause on resource allocation of SafeDAO”, carried on 250 voters. Then nothing until SEP 55 in April 2026, on 93 voters. Then nothing until SEP 56, created 23 September 2026 and closing 6 October. As of 5 October it had 25 voters and 7,107,054 SAFE against that same 10,000,000 quorum.
Twenty-five. The space has 17,729 followers. SEP 5, back in March 2023, pulled 2,107 voters. SEP 22 pulled 1,028. The count is still perfectly verifiable; there is simply almost nobody left to count.
The one vote that did not need a board
SafeDAO has passed real things. The question worth asking is which of them the DAO could execute without asking anyone, and the answer is: one.
SEP 22, closed 15 April 2024, unpaused the SAFE token contract and enabled transferability: 54,236,749 for, 3,046 against, 491,836 abstaining, on 1,028 voters. We read the deployed contract rather than trusting the description. On Ethereum mainnet, the Safe Token at 0x5aFE3855358E112B5647B952709E6165e1c1eEEe reports a total supply of exactly 1,000,000,000 tokens and paused() returns false.
More to the point, we checked the function dispatcher in the deployed bytecode for the selectors that would matter. unpause() is there. pause() is not there at all. Neither is a mint or a burn. The contract was built so that unpausing is a door that only opens, once, in one direction.
That matters because the contract still has an owner. owner() returns 0x8CF60B289f8d31F737049B590b5E4285Ff0Bd1D1, which is itself a Safe, a proxy pointing at the v1.3.0 singleton, with five owner keys and a threshold of three. It holds 348,143 SAFE, about 0.035% of supply. Three signatures out of five control that address, and no SEP can change who those five are.
And it does not matter, because there is nothing for them to re-pause. The thing SafeDAO voted for in April 2024 is the one decision in its history that no board, no supervisor and no Swiss authority can reverse, because the reversal was never compiled. Everything else, the treasury, the strategy, the board seats, the oversight, is a request addressed to three people in Zug.
That is the entire distinction this blog exists to make, handed over by someone else’s governance crisis.
Quorum failure is not a no
Here is the asymmetry worth sitting with. When SEP 51 passed, the result was legible: the DAO said yes. When SEP 50 missed quorum, what did the DAO say?
Not no. More Accept weight voted than Make No Changes weight, by better than two to one. The proposal did not lose an argument. It failed to attract enough attention to constitute an answer at all, and a system that requires a minimum turnout to speak is a system that goes silent exactly when people stop showing up. Which is, of course, precisely when oversight proposals get written.
A verifiable tally gives you one guarantee and people routinely stretch it into three. It guarantees the arithmetic: these addresses held this weight at this block and the sum is reproducible by anyone. It does not guarantee that the number was large enough to mean something, and it does not guarantee that the body on the receiving end is obliged to act. Those are separate properties and they fail separately.
We have argued a neighbouring version of this before and it is worth being precise about the difference. When Solana’s first network vote closed in August 2026, the point was that a verifiable tally is not a readable mandate: the count was auditable but you could not reconstruct whether delegated stake expressed its owners’ preferences. That is a question about who the vote represents. When Robinhood’s stock tokens came up, the point was that tokenising an instrument copies the price and leaves the membership behind, so a holder never had a vote to cast in the first place. That is a question about what the token was granted.
Safe is neither. SAFE holders were granted a real governance right. They exercised it. The count was honest. And the right still stops dead at the boundary of a legal person, because governance rights are granted by the people who wrote the token and standing is granted by a statute written in 1907 and amended in 2021. The two were never connected. Nobody said they were. Nobody asked either.
Our previous instalment made the mirror-image observation about EU consumer enforcement: there, a regulator can act with no damages threshold, no residency and no standing required from the consumer at all. Here the consumer-equivalent has the money, the conviction and the four-year position, and the statute does not list him.
What this is worth to anyone running a game
Satoshie runs raffles and coinflips settled by Chainlink VRF on Base. The relevant property is not that the randomness is good. Plenty of things produce good randomness. The relevant property is that the step after the randomness is a state transition, not a decision.
When a draw closes, a VRF proof is verified on-chain and the same execution path that accepts the proof selects the winner and moves the prize. There is no interval in which a body has received a correct result and must now choose to honour it. There is no quorum for the payout. There is no minimum turnout below which the contract declines to answer. You do not need 10,000,000 of anything to vote for your own prize, and nobody has to show up alongside you for your verification to work. That last clause is the one that distinguishes a proof from a poll: a proof is complete for one person acting alone.
These are the rules we think Satoshie should be judged against, and we want to be exact about the status of that sentence. We do not hold the deployed contract source locally, so the paragraph above is a statement of the standard, not a report on our bytecode. We have now flagged that gap in four posts across four weeks. The honest position is that a reader should check the deployed contract on BaseScan rather than take a blog’s word for it, which is the same thing we just did to Safe’s token rather than reading its documentation.
Honest limits
Several, and they are real.
Greenfield’s figures are Greenfield’s. The $66 billion to $30 billion decline in assets held in Safe accounts, the fall in USDC share from 12.8% to 2.5%, the $1.98 million of Q2 2026 revenue against a target implying roughly $20 million, the claim that roughly $60 million of a $93.5 million raise has been spent: these come from an open letter written by a party in a dispute, some of it citing the Foundation’s own MiCA disclosures. We have not audited any of it and the Foundation has not yet responded publicly. The allegations about board conduct after the Bybit incident are allegations, sourced to conversations, and should be read that way.
The quorum reading has an edge. We took 10,000,000 SAFE from the Snapshot space configuration and compared it to total votes cast. SafeDAO’s own governance framework defines the rule, and it is possible that the operative quorum counts something narrower than every vote cast. What does not depend on that arithmetic is the thing Greenfield’s letter establishes directly: the oversight it proposed through the DAO in 2024 does not exist in 2026, which is why it is now describing the problem to a federal authority instead.
The 3-of-5 multisig that owns the SAFE token contract carries no public label. It is a Safe, we can read its threshold and its five keys, and we are not asserting whose keys they are. Given there is no pause() to call, it changes nothing in the argument either way.
And Safe may well be right. A board that resists being restructured by one investor is doing something foundations are deliberately built to do. The founder’s purpose is supposed to outlive whoever is loudest this quarter. None of the above is a claim that Greenfield should win. It is a claim about where the argument had to be held.
Three questions
For any platform where a published rule governs your money:
If the rule changed against me, what is the name of the body I would have to persuade, and what document says it must listen? If the answer is a forum post rather than a statute or a contract, you are holding a preference, not a right.
Does my ability to verify last night’s outcome depend on anyone else participating? If verification needs a quorum, a turnout figure or a minimum number of other people caring, it is a poll. A proof works for one person at three in the morning.
Which decisions here are executed by code, and which are executed by people who have been told the result? Make the list. On Safe, that list has one item on it, and it is four years old.
The closer
SafeDAO built a governance system that counts honestly, publishes its thresholds, records every vote and can be audited by anyone. All of that worked. The count was never the problem.
The problem is that the count was addressed to a Swiss foundation, and a Swiss foundation answers to a supervisor in Bern rather than to the people holding the token. When its own backer concluded the system could not deliver, it did not open a proposal. It wrote to a federal authority in Bern.
Provable fairness tells you the number is real. It will never tell you the number is owed anything. That is the lever nobody weighed, and almost every system that calls itself governed has one.
📷 Photo by Ansgar Scheffold on Unsplash
