# Governance deadlock by single actor

One role can cancel or veto what only another role can propose, with no override or replacement path

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-08-27. Updated 2026-10-24._

## How it works
Governance assumes no single actor can both block progress and be irreplaceable. The assumption breaks when one role holds a blocking power (cancel or veto) over actions that only another role can initiate, and neither role can be removed or bypassed. If either key is lost or malicious, the system has no path forward: the blocker cannot be overridden, and the proposer cannot be replaced. The result is permanent deadlock, not a temporary stall.

## Where it shows up
- A `cancel`/veto permission granted to a role that is not the sole proposer, with no timelock escape or emergency bypass [E1](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-13.md)
- An owner/proposer that cannot call `executeInstant` or self-replace, making it a single point of failure [E1](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-13.md)
- Asymmetric permission sets: one role proposes, a different role cancels [E1](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-13.md)
- Upgrade scheduling logic where cancellation applies to all pending operations regardless of who scheduled them [E1](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-13.md)

## How to review
Enumerate every actor and its full permission set, then ask for each: if this key is lost or malicious, is there any recovery path? The invariant: no single actor may hold an exclusive blocking power over an action it cannot itself perform, and every privileged role must be replaceable or bypassable. Concretely, check whether the proposer can execute without the canceller, whether the canceller can be removed by anyone else, and whether any timelock or emergency path bypasses both. Trace self-calls through `execute`/`executeInstant` to confirm the owner's real reach.

## Variants seen
- Cancel-vs-propose asymmetry between securityCouncil and owner deadlocking upgrades [E1](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-13.md)
- Compromised owner that is the sole proposer and cannot be replaced, blocking all recovery [E1](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-13.md)

## Impact and severity
Permanent governance deadlock with no upgrade path [E1](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-13.md). Severity is highest when the blocking actor is a single key and no timelock or emergency path exists, since a single compromise or refusal freezes the protocol indefinitely.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-13.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-08-verwa%3AH-06.md
- E3: https://bugbountylibrary.com/r/cantina%3Aprimev_oct2024%3A3.2.7.md