The upgrade deployment script failed to call an important initialization function, leaving the vote threshold at zero and allowing anyone to withdraw “without signature.”