Cowrie Research

mutable-threshold-state-self-bricking

12 min read

Mutable Threshold-State Self-Bricking / Governance Liveness Collapse

  • Name: mutable threshold-state self-bricking / governance liveness collapse
  • Category: exploit pattern / governance failure / constitutional liveness failure / mutable-electorate-threshold collapse / rescue-window mismatch
  • Summary: This pattern appears when a protocol’s own governance thresholds, quorum rules, proposer eligibility, or cancellation conditions depend on mutable accounting state that an adjacent subsystem can corrupt faster than governance can repair it. The protocol is not captured by hostile voters in the usual sense. Instead, the constitution loses the ability to act: the variables that define who can propose, how many votes are needed, or whether a queued rescue still qualifies are themselves distorted by a rebase bug, supply bug, accounting explosion, or similar state corruption. Once that happens, a rescue proposal may already be too late, ordinary timelock delay becomes fatal, and treasury or reserve assets can remain stranded because governance has become mathematically unreachable.
  • Quick routing split: YAM Finance is the clean current exemplar: a rebase arithmetic bug corrupted totalSupply, then initSupply, and the same poisoned state exploded proposal threshold and quorum before the queued fix could execute. Use borrowable-governance-weight when the decisive question is temporary outside capital becoming valid constitutional weight, governance-capture when a hostile bloc actually seized governance authority, and deprecation-without-deauthorization when the problem is not liveness collapse but an old authority surface still being live.
  • What it is:
    • Governance defines proposal threshold, quorum, cancellation rights, voting weight, or rescue-path eligibility using mutable state such as supply, reserves, shares, or another accounting variable that can still move after deployment.
    • An adjacent subsystem corrupts or explosively changes that state through a bug, arithmetic omission, migration mistake, or other non-governance failure.
    • The same corrupted state now also determines whether governance can still propose, pass, queue, keep alive, or execute a repair.
    • Governance therefore stops being the repair mechanism and becomes another casualty of the bug.
    • A rescue path may exist in principle, but the protocol’s own timing or threshold rules ensure the rescue arrives after the fatal next state transition.
  • Typical preconditions:
    • Proposal thresholds or quorum are functions of mutable protocol state rather than a separately bounded constitutional supply object.
    • Another subsystem can change that state automatically: rebases, reserve minting, accounting sync, share-price refresh, migration routines, or reward distribution logic.
    • There is a known next state transition that will worsen the corruption before governance can complete a normal fix path.
    • Timelock, voting period, queue delay, or cancellation logic remains tied to the same state that is about to become invalid.
    • No out-of-band guardian, hardcoded emergency patch lane, or precommitted liveness-preserving circuit breaker can bypass the ordinary governance path.
  • Common vulnerable surfaces:
    • rebasing tokens whose supply variables also feed governance thresholds
    • reserve or treasury mint paths that mutate the same denominator governance uses for quorum
    • protocols where proposal threshold and quorum derive from live totalSupply, initSupply, or another variable that monetary-policy logic can distort
    • systems whose queued rescue proposals can later be canceled because the proposer’s vote weight is re-evaluated against a now-corrupted threshold
    • constitutions that require ordinary timelock and voting latency even when the next scheduled state transition will destroy governance liveness
  • Failure sequence:
    1. A bug corrupts or explosively changes some live accounting state.
    2. The protocol discovers the bug and turns to governance as the intended repair path.
    3. A rescue proposal is created, delegated to, or even queued under the pre-corruption or partially corrupted state.
    4. Before the rescue can execute, another scheduled state transition, delayed queue, or dependent accounting path worsens the corrupted state.
    5. Proposal threshold, quorum, cancellation rights, or proposer eligibility re-evaluate against the new broken denominator and become unreachable or unstable.
    6. The queued rescue can fail quorum, miss its execution window, or become cancelable even though the community already identified the fix.
    7. Governance loses the ability to modify the system, and funds, reserves, or migration-critical state remain stuck behind an unrepairable constitution.
  • Variants:
    • Supply-denominator explosion — rebasing or mint logic corrupts the supply variable governance uses for quorum or proposal threshold, as in YAM.
    • Queued-rescue invalidation — a proposal was valid when submitted or queued, but later state mutation causes proposer eligibility or cancellation conditions to flip against it.
    • Timelock-versus-next-transition race — the protocol can identify the fix quickly, but mandatory delay means the next fatal state transition lands first.
    • Constitutional denominator coupling — governance and monetary/accounting logic share one mutable state object that should have been decoupled.
  • Detection heuristics:
    • Ask which exact variables define quorum, proposal threshold, proposer eligibility, and cancellation conditions, then ask which non-governance code paths can still mutate them.
    • Treat any rescue analysis as a race against the next automatic state transition. We can pass a proposal is not enough if execution lands after the next corruption event.
    • Model whether queued proposals remain valid under post-bug state, not only whether they were valid at submission time.
    • Be suspicious whenever governance thresholds depend on rebasing supply, reserve balances, share counts, or other values that can move mechanically rather than only by explicit constitutional action.
    • If a bug report says funds are safe if governance can act before X, the protocol likely has a constitutional liveness dependency, not just an accounting bug.
  • Defenses:
    • Define governance thresholds from a bounded constitutional supply object that adjacent monetary-policy or reserve-accounting code cannot silently corrupt.
    • Keep emergency repair authority on a narrower lane with explicit scope, shorter latency, and hardcoded liveness assumptions rather than routing every rescue through ordinary slow governance.
    • Make queued emergency repairs survive denominator drift: once a valid rescue enters the emergency lane, later threshold explosions should not make it cancelable by arithmetic accident.
    • Add fail-closed behavior around scheduled transitions. If a known bug would worsen at the next rebase, epoch roll, or sync, the system should be able to halt that transition before it mutates governance-critical state again.
    • Treat proposal-threshold and quorum variables as balance-sheet-critical interfaces, not harmless governance metadata.

What sound design looks like

  • Governance liveness is anchored to a constitutional object that accounting bugs cannot casually rewrite. Proposal threshold and quorum should depend on a deliberately governed, separately reviewable electorate base rather than a live monetary-policy denominator that can explode from a math bug.
  • Rescue authority has a deliberately shorter and narrower path than ordinary policy changes. Pausing a rebase, halting a reserve-mint path, or migrating to a temporary governor should not need the same latency budget as an everyday treasury or parameter proposal when the whole point is preserving constitutional liveness.
  • Scheduled transitions can be frozen when they threaten constitutional reachability. A system should be able to say do not perform the next rebase / epoch sync / reserve sweep until the constitutional repair lands instead of forcing governance to race the clock.
  • Emergency proposals are durable once properly admitted. If a rescue proposal was valid under the pre-collapse electorate, later denominator corruption should not be able to retroactively strip its proposer qualification or make it trivially cancelable.
  • Reviewers can separately answer two questions: what governs the economy? and what governs the governor? Healthy systems do not let the same fragile variable answer both.

Three constitutional-liveness promotions reviewers should not collapse

  1. Some live accounting denominator or scheduled transition exists at all

    • Supply, reserve, share, or epoch state can still move, and governance formulas still read that moving state somewhere.
    • That only proves a mutable denominator or time-triggered transition still exists.

  2. That mutable state still counts as canonical constitutional threshold truth

    • The harder question is whether rebase-authored totalSupply, reserve-mutated initSupply, share-rescaling state, or another nearby accounting object still deserves to define proposal threshold, quorum, proposer eligibility, or cancelability for this exact constitution.
    • Most incidents in this family fail here: the protocol promotes this nearby accounting variable changed into this is still the one authoritative electorate denominator the governor should trust.

  3. That accepted threshold truth still deserves to gate the only repair lane right now

    • Even if a constitutional denominator is temporarily suspect, healthy systems should not force every liveness-preserving pause, rescue, or migration through the same now-corrupted thresholds and delays.
    • This is where emergency-lane durability, threshold freezes, and transition halts matter: the accepted denominator should not also get to decide whether the protocol may save itself before the next fatal transition lands.

Healthy review gets materially better once teams stop flattening those three promotions into one vague sentence like governance can still fix it if we move fast.

Failure-prevention checklist

  • Derive proposal threshold, quorum, cancellation rules, and emergency-vote eligibility from a bounded constitutional base rather than live rebasing or accounting denominators.
  • Inventory every non-governance code path that can still mutate governance-critical threshold state: rebases, reserve mints, share rescalings, emissions, migration syncs, accounting repairs, and reward sweeps.
  • Add a narrow emergency lane for liveness-preserving actions such as pausing rebases, freezing reserve mutation, or migrating to a temporary governor with precommitted lower-latency rules.
  • Ensure queued emergency fixes cannot be invalidated by the same state corruption they are trying to repair. Admission and survival conditions should be explicit.
  • Rehearse bug discovered before next automatic transition scenarios. If the team can explain the fix but not how it lands before the next scheduled mutation, the design is still too brittle.
  • Keep cancellation rights from depending naively on live proposer voting weight when denominator corruption could make valid rescue proposals cancelable after the fact.
  • Treat timelock delay as a liveness-budget variable, not only a review-safety variable. Some failures are worsened by delay rather than mitigated by it.
  • Add invariant monitoring for sudden threshold blowouts: proposal threshold, quorum, or required delegated voting power should not change by absurd multiples without paging responders immediately.

Audit prompts

  • Which exact variables determine proposal threshold, quorum, and proposer eligibility, and which code paths outside governance can still mutate them?
  • If the next rebase, epoch roll, reserve mint, or accounting sync runs while the system is already in a broken state, does governance become more or less able to repair the damage?
  • Once a rescue proposal is submitted or queued, can later denominator drift cause it to fail quorum, lose proposer qualification, or become cancelable?
  • What narrow emergency action can halt the next state transition if ordinary governance delay would otherwise be fatal?
  • Does the protocol have a constitutional supply / electorate object that is intentionally decoupled from monetary-policy and reserve-accounting state?
  • If a bug suddenly inflated supply or reserves by orders of magnitude, what would happen to quorum, proposal threshold, and cancellation logic on the next block?
  • Is timelock delay improving safety here, or is it merely guaranteeing the bug gets a second chance to corrupt the electorate before the fix lands?
  • Can monitoring explain in real time why governance thresholds moved, or would defenders only discover the new unreachable quorum after their rescue already failed?

Lessons that should already be standard

  • Governance is not a real repair mechanism if the bug can rewrite the arithmetic that says governance is allowed to act.

  • Timelock delay is not always safety. When the next scheduled state transition is the thing that destroys repairability, delay becomes part of the exploit path.

  • Monetary-policy state and constitutional state are different control surfaces. Letting rebases or reserve accounting directly set proposal threshold and quorum is a design smell.

  • Rescue proposals should be protected against denominator collapse. Otherwise the protocol can correctly diagnose its own bug and still die because the constitution recalculated itself out of reach.

  • We can fix this with governance is not a meaningful statement until someone proves governance still survives the next automatic state change.

  • The clean design question is blunt: if a subsystem bug goes off right now, what keeps the governor from becoming mathematically unreachable before the patch executes?

  • High-signal incidents:

    • [[../../../incidents/governance-admin-upgrades/yam-finance-rebase-totalsupply-inflation-governance-bricking-2020-08-13|YAM Finance rebase totalSupply inflation / governance bricking (2020-08-13)]] — the canonical current exemplar: a missing / BASE in rebase() first corrupted totalSupply, then poisoned initSupply, and the same broken denominator blew out proposal threshold and quorum before the queued rescue could clear GovernorAlpha’s fixed delay.

Where this pattern stops

  • Use governance-capture when a hostile voter bloc, not denominator collapse, actually seized constitutional authority.
  • Use borrowable-governance-weight when the real break is that temporary borrowed capital became valid voting weight.
  • Use governance-decay-remnant-authority-capture when the electorate became cheap because attention decayed, not because threshold arithmetic self-corrupted.
  • Use deprecation-without-deauthorization when the problem is that an old authority surface stayed live, not that governance lost the ability to act at all.
  • In short: this pattern begins once the protocol’s own mutable threshold arithmetic makes governance unreachable, and it stops once the sharper story is instead hostile vote acquisition, remnant-authority capture, or stale live authority.

Internal linkages

Control surface

Graph View

Backlinks