The upgrade deployment script failed to call an important initialization function, leaving the voting threshold at zero and allowing anyone to withdraw “without a signature.”