# Multisig can execute the same proposal repeatedly

MultisigBase's onlySigners modifier resets vote tally after execution, letting concurrent signer votes re-execute the same proposal twice.

- Payout: Contest reward
- Severity: medium
- Program: Axelar Network
- Credited: pcarranzav
- Disclosed: 2023-11-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-axelar-findings/issues/116
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** MultisigBase/Multisig governance contracts (Solidity)
**Root cause:** The onlySigners modifier resets the vote count and executes the external call once the threshold is met; votes arriving in the same block after execution start a fresh tally and can meet the threshold again, re-executing the same call.
**Steps:**
1. Set threshold to 1 via rotateSigners(accounts, 1)
2. signer1 calls `multisig.execute(target, calldata, nativeValue, {value: nativeValue})` — threshold met, call executes, tally reset
3. signer2 calls the same `execute` with identical args in same block — new tally reaches threshold, call executes again
4. TargetCalled emitted twice; same proposal executed twice
**How found:** Reading the onlySigners modifier logic and noticing vote-count reset after execution; modified existing unit test to threshold 1 to demonstrate double execution.
**Exploitation:** Signers submitting votes in the same block (or overvoting) cause the external call to execute multiple times; accidental double execution of a fund transfer can drain value. Requires trusted signers acting concurrently, not a malicious external attacker.
**Insight:** When auditing multisig/threshold vote tallying, check whether the tally is cleared before or after the external call and whether concurrent same-block votes can re-satisfy the threshold for an identical proposal hash.