Skip to content

fix: remove signer ordering constraint in multi-sig approve - #232

Closed
ZacLou wants to merge 1 commit into
Vero-protocol:mainfrom
ZacLou:fix/multisig-approve-deadlock-176
Closed

ZacLou wants to merge 1 commit into
Vero-protocol:mainfrom
ZacLou:fix/multisig-approve-deadlock-176

Conversation

@ZacLou

@ZacLou ZacLou commented Sep 5, 2026 •

Copy link
Copy Markdown

Summary

Closes #176

Problem

governance::approve() required signers to approve in strictly increasing signer-index order. If a higher-index signer approved before a lower-index one, every signer with a lower index became permanently unable to approve — even if quorum could still be met. In the worst case, the highest-index signer could unilaterally and permanently deadlock any proposal (threshold >= 2) just by approving first.

Root cause

if !proposal.approved_by.is_empty() {
    let last_signer = proposal.approved_by.get(proposal.approved_by.len() - 1).unwrap();
    let last_index = signer_index(env, &last_signer);
    let current_index = signer_index(env, signer);
    if current_index <= last_index { panic_with_error!(env, GovError::InvalidSignerOrder); }
}

Fix

Removed the signer ordering constraint (10 lines). The existing proposal.approved_by.contains(signer) check on line 206 already prevents double-approval. Any signer who hasn't yet approved can now approve at any time, in any order, until threshold is reached.

Impact

  • Security improvement: prevents permanent governance deadlock
  • No new dependencies or attack surface — the double-approval guard remains in place
  • Backward compatible: existing valid approval sequences continue to work unchanged

…t deadlock (Vero-protocol#176)

The ordering constraint required signers to approve in strictly
increasing signer-index order. If a higher-index signer approved
before a lower-index one, every signer with a lower index became
permanently unable to approve — even if quorum could still be met.

The approved_by.contains check already prevents double-approval.
Removing the ordering constraint allows any signer to approve at
any time, in any order, until threshold is reached.

Addresses Vero-protocol#176
@ZacLou
ZacLou requested review from N-i-xx and N-thnI as code owners September 5, 2026 11:54
@ZacLou

ZacLou commented Sep 27, 2026

Copy link
Copy Markdown
Author

Closing this to keep the queue tidy.

@ZacLou ZacLou closed this Sep 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Multi-sig proposal approval permanently deadlocks when a higher-index signer approves before a lower-index signer

1 participant