# Governance lock and veto bypass

Privileged or batched paths that skip lock, expiry, or veto checks on delegated or bundled state

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-02-05. Updated 2026-10-23._

## How it works
Governance contracts enforce a lock or veto by checking state at one point, but a second code path mutates the same state without re-checking. The assumption that "all paths that change lock/delegation state enforce the same invariant" breaks. A delegator's lock end can be reset below the delegatee's, an emergency cancel can be disabled by bundling a protected action, or an expiry guard can live in only one branch of a delegation if/else.

## Where it shows up
- Privileged functions (forceUndelegate, blocklist, slasher) that rewrite lock end or delegation without comparing to the delegatee's lock [E1](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AH-02.md)
- Emergency controls (cancelProposal, guardian veto) that scan a batch and revert on a protected action, letting attackers bundle it with harmful ones [E2](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.2.md)
- Expiry or lock checks placed inside only one branch of an `if (delegated) ... else ...` [E3](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-03.md)
- Multi-action proposals where one action disables the safety check for the rest

## How to review
For every path that writes lock end, delegation, or proposal state, confirm the invariant holds: a delegator's lock end >= delegatee's lock end, and expired locks cannot be extended [E1](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AH-02.md)[E3](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-03.md). For veto/cancel logic, verify the control cannot be disabled by any action an attacker can include in the same batch [E2](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.2.md). Check that guards are applied uniformly across all branches, not just the non-delegated one [E3](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-03.md).

## Variants seen
- Force-undelegate resets lock to the delegator's short lock instead of the delegatee's long lock, enabling early withdrawal [E1](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AH-02.md)
- Guardian cancel disabled by bundling setGuardian with fund-draining actions [E2](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.2.md)
- Expired lock extended via delegation because the expiry check is skipped in the delegated branch [E3](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-03.md)

## Impact and severity
Lock commitments and emergency vetoes are the core safety of governance. Bypassing them lets attackers withdraw locked votes early [E1](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AH-02.md), push through malicious proposals that cannot be cancelled [E2](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.2.md), or revive expired voting power [E3](https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-03.md). Severity is high where the bypass defeats a time-lock or veto protecting funds; worse when the bypass is reachable by any delegator or proposer without special privilege.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AH-02.md
- E2: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.2.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-08-fiatdao%3AM-03.md