# Signature quorum without per-signer verification

Quorum counts signatures by arrival order or total count while only a subset is actually verified

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2024-08-04. Updated 2026-10-23._

## How it works
A threshold check is only as strong as the set of signatures it actually validates. The root cause is a mismatch between the set of signatures that is *counted* and the set that is *verified*. Code may count signatures by arrival order, by total length, or over all entries, while the underlying verifier (Safe, a chain module, a client pipeline) only checks a subset — usually the first `threshold` entries. Any signature outside the verified subset still influences the outcome, so an unauthorized or invalid signer can occupy a quorum slot. The broken assumption is that "N signatures present" equals "N valid, distinct, authorized signers."

## Where it shows up
- A guard or module re-implementing signature validation on top of a base verifier (e.g. Safe) with a different loop bound [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-3.md).
- Counting loops over `signatures.length/65` or all entries while the base check loops `i < threshold` [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-3.md).
- Non-data-binding signature types (v==0/v==1) that let a stale signature be reused [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-3.md).
- Subset processing (first N signatures) combined with enforced ascending owner-address ordering [E2](https://bugbountylibrary.com/r/cantina%3Aoptimism_may2024%3A3.1.1.md).
- Client code collecting partial signatures by arrival order into a quorum without verifying each [E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.9.md).

## How to review
The invariant: the exact set of signatures counted toward quorum must equal the set individually verified as valid, distinct, and authorized. Check that any re-implementation uses the same subset and bounds as the base verifier [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-3.md). Confirm each partial signature is verified before it counts [E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.9.md). Confirm ordering cannot let one signer displace another's processed slot [E2](https://bugbountylibrary.com/r/cantina%3Aoptimism_may2024%3A3.1.1.md).

## Variants seen
- Divergent subset: counter iterates all sigs, verifier checks first threshold [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-3.md).
- Censorship via appended extra signature under ordering rules [E2](https://bugbountylibrary.com/r/cantina%3Aoptimism_may2024%3A3.1.1.md).
- Arrival-order quorum poisoned by a fast invalid signature [E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.9.md).

## Impact and severity
Led to threshold bypass [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-3.md), signer removal/censorship [E2](https://bugbountylibrary.com/r/cantina%3Aoptimism_may2024%3A3.1.1.md), and invalid transactions rejected by the counterparty [E3](https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.9.md). Severity is high where quorum guards funds or liveness; worse when ordering or non-binding sig types widen the gap between counted and verified sets.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AH-3.md
- E2: https://bugbountylibrary.com/r/cantina%3Aoptimism_may2024%3A3.1.1.md
- E3: https://bugbountylibrary.com/r/cantina%3Ababylon_may2024%3A3.2.9.md