# Duplicate signer threshold bypass

Threshold sums weight or counters per signature entry without deduplicating signers or enforcing key distinctness

_Area: Smart contract access control and control flow. Seen in 5 disclosed reports; latest 2026-03-13. Updated 2026-10-23._

## How it works
A threshold check assumes each signer contributes at most once. When verification loops over a caller-supplied array and adds weight or increments a counter per valid entry without tracking which signers already contributed, one signer repeating their own signature satisfies any threshold. The invariant that must hold: the weight compared to the threshold is summed over unique signers, not over array entries. Because the caller controls the array, the check collapses to "one signer, many entries." A related-but-distinct shape is key distinctness: when role-specific keys are never checked for equality, two roles resolve to one key and a multi-party path collapses to a single party.

## Where it shows up
- Loops that recover an address per signature and add weight or a counter with no seen-set, bitmap, or sorted-unique check [E1](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-03.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-2.md)[E3](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-01.md).
- Weighted multisig where the signatory array is never checked for uniqueness before weight accumulation [E3](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-01.md).
- Governance/veto functions that add the caller's voting power without a per-(proposal, voter) hasVoted record [E5](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-08.md).
- Role-specific keys (staker, finality provider) with no distinctness check, so two roles collapse into one key [E6](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md)[E7](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md).
- Membership-only filtering of weighted contribution lists, where duplicates multiply one actor's weight downstream [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-1.md).

## How to review
Find every place weight or a counter is summed from a caller-supplied array. Confirm the counted signer set is unique: look for a seen-set, bitmap, or enforced sorted-unique ordering, and check the ordering is actually validated, not just assumed. For vote-accumulating functions, confirm dedup is keyed on (proposal, voter) [E5](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-08.md). For key-based schemes, confirm the code rejects a key appearing in two roles (e.g. stakerKey == finalityProviderKey) [E6](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md)[E7](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md). For weighted contribution lists, confirm duplicates are rejected before aggregation [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-1.md).

## Variants seen
- Counter incremented per valid signature, no signer tracking [E1](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-03.md).
- Voting power summed per proof entry, duplicates inflate power [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-2.md).
- Weighted quorum sums signatory weight without dedup [E3](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-01.md).
- Veto vote re-callable by same address, minority reaches threshold [E5](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-08.md).
- Self-referential key collapses a multi-party slashing path [E6](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md)[E7](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md).
- Duplicate weighted contributions counted in downstream aggregation [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-1.md).

## Impact and severity
Threshold bypass on cross-chain message verification [E1](https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-03.md), malicious batch approval by one low-power validator [E2](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-2.md), quorum bypass [E3](https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-01.md), minority veto of any proposal [E5](https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-08.md), collapsed slashing requirements [E6](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md)[E7](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md), and skewed inference values [E4](https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-1.md). Severity is highest where the threshold guards asset movement or consensus; worse when one signer can repeat cheaply and no downstream check re-validates uniqueness.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-08-chakra%3AH-03.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AH-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-01.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-06-allora%3AH-1.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AH-08.md
- E6: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md
- E7: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md