# Previous {Operators/Weights/Threshold} Are Still Able To Sign Off New Commands After Operatorship Is Transferred

AxelarAuthWeighted retains 16 old operator sets, letting a validator whose weight was reduced reuse a prior epoch's weights to sign new commands alone.

- Payout: Audit contest
- Severity: medium
- Program: Axelar Network
- Found by: xiaoming90
- Disclosed: 2022-10-06
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2022-07-axelar#m-04
- Library page: http://bugbountylibrary.com/r/c4%3A2022-07-axelar%3AM-04
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:access-control vuln:business-logic vuln:signature-replay

**Target:** AxelarGateway.execute / AxelarAuthWeighted.validateProof
**Root cause:** validateProof accepts any of the last 16 operator-set hashes without binding signatures to a timestamp, so old weights/thresholds remain valid for newly signed commands after transferOperatorship.
**Steps:**
1. At epoch 1, operators [Alice,Bob,Charles] weights [0.5,0.25,0.25] threshold 0.5; Alice alone meets threshold.
2. Admin calls transferOperatorship to epoch 2 weights [0.25,0.4,0.4] threshold 0.5, reducing Alice's weight.
3. Alice submits `execute(input)` with proof `{operators:[Alice,Bob,Charles], weights:[0.5,0.25,0.25], threshold:0.5, signatures:[Alice]}` reusing epoch 1 hash.
4. validateProof finds epoch 1 hash within OLD_KEY_RETENTION=16 and accepts; command executes despite Alice's reduced current weight.
**How found:** Code review of validateProof's OLD_KEY_RETENTION logic; noticed retention was meant for recently-signed-but-unexecuted commands but applies to any new signature.
**Exploitation:** A validator whose weight was cut reuses its old operator address/private key and the prior epoch's operator-set hash to sign fresh commands, satisfying the old threshold without co-signers.
**Escalation:** Repeated transferOperatorship calls can be sidestepped; a malicious operator cannot be kicked out of signing.
**Insight:** When key rotation keeps old keys valid for a grace window, check whether the window is bound to signature time or message time; without timestamps, old keys sign new messages.