# Missing role key distinctness check

Role keys compared or combined without asserting they differ, collapsing multi-party checks

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-09-06. Updated 2026-10-23._

## How it works
Protocols assume that keys or addresses filling different roles are distinct parties. When code combines or replaces role keys without asserting they differ, one party can occupy two roles. A quorum that should need independent signatures collapses into one signer, or a list that should hold unique entries holds duplicates. The safety property (multiple parties must agree) silently becomes a single-party check.

## Where it shows up
- Update/replace functions that overwrite a list entry with a caller-supplied value and never check the value is absent from the list [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-08.md).
- Builders that take a staker key and a set of provider keys and never compare them [E2](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md)[E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md).
- Validation routines that check key length or format but not cross-role distinctness [E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md).
- Slashing or punitive paths gated on signatures from roles that could be the same key [E2](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md).
- Removal logic that deletes only the first match, so duplicates persist [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-08.md).

## How to review
Identify every place two role keys are compared, combined, or substituted. The invariant: for any operation relying on distinct parties, the code must reject equality (or membership overlap) between those keys before proceeding. Check the constructor/validate path and the transaction-builder path separately, since one may enforce it and the other not [E2](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md)[E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md). For list updates, confirm the new value is checked against existing entries and that removal handles all occurrences [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-08.md). Trace how the list feeds downstream per-entry accounting to see the consequence of duplicates.

## Variants seen
- Blind in-place address replacement creating duplicate observers, offsetting a victim's rewards via missed-vote penalties [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-08.md).
- Staker key equal to finality provider key, making funds instantly slashable by the user's own signature [E2](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md).
- Staker key included in the finality provider key set, producing invalid staking transactions users then fund and sign [E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md).

## Impact and severity
Consequences ranged from reward theft and griefing [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-08.md) to instant loss of staked funds [E2](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md) and invalid funded transactions [E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md). Severity is high because the broken assumption undermines the core multi-party guarantee. It worsens when the collapsed path is punitive (slashing) or when duplicates propagate into accounting that sums per-entry.

## Why fixes fail
Evidence shows the check missing in both the Go builder [E2](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md) and the TypeScript library [E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md), suggesting fixes applied to one layer leave the other exposed; enforce distinctness in every entry point that constructs or validates role keys.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-08.md
- E2: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.7.md
- E3: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.8.md