# High-risk actions aren't all covered by the existing checks

Olympus governance's high-risk check omits MigrateKernel and _setModuleRiskLevel, letting a low-quorum proposal brick the protocol or lower risk thresholds.

- Payout: Contest reward
- Severity: medium
- Program: Olympus On Chain Governance
- Credited: IllIllI
- Disclosed: 2024-01-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-olympus-on-chain-governance-judging/issues/104
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-olympus-on-chain-governance%3AM-4
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** GovernorBravoDelegate governance contract (_isHighRiskProposal)
**Root cause:** _isHighRiskProposal only flags module upgrades and policy install/deactivate actions whose keycodes are high-risk; it never treats MigrateKernel or _setModuleRiskLevel calls as high-risk, so they execute under the normal low quorum.
**Steps:**
1. Read `_isHighRiskProposal()` in GovernorBravoDelegate.sol; note only action==1 (module upgrade) and action==2/3 (policy install/deactivate) are inspected.
2. Observe `MigrateKernel` action and calls to `_setModuleRiskLevel()` fall through without returning true.
3. Submit a proposal targeting the kernel migration or risk-level setter; it passes with the standard (lower) quorum.
4. Execute to migrate the kernel (bricking protocol per Kernel.sol#L338) or remove modules from `isKeycodeHighRisk`, lowering future thresholds.
**How found:** Code review of the high-risk classification logic: noticed the mapping of high-risk keycodes is checked but mutations of that mapping and kernel migration are not enumerated as high-risk actions, contradicting the stated high-risk invariant.
**Exploitation:** Attacker gathers only the normal quorum (not the elevated high-risk quorum), proposes a MigrateKernel action or a _setModuleRiskLevel change, and executes it, bricking the protocol or stripping high-risk classification from sensitive modules.
**Escalation:** Removing modules from isKeycodeHighRisk permanently lowers the quorum bar for all future sensitive proposals, compounding the impact.
**Insight:** When a contract gates actions by an allowlist/mapping of 'dangerous' operations, audit the operations that mutate the allowlist itself and any escape-hatch functions (kernel migration, executor change) — they are frequently omitted from the gate.