fix(governance): add check for strict Multisig threshold validation

contracts/gateway/AxelarAmplifierGateway.sol

@@ -53,6 +53,8 @@ contract AxelarAmplifierGateway is BaseAmplifierGateway, BaseWeightedMultisig, U
     function _setup(bytes calldata data) internal override {
         (address operator_, WeightedSigners[] memory signers) = abi.decode(data, (address, WeightedSigners[]));
 
+        // operator is an optional parameter. The gateway owner can set it later if needed.
+        // This also simplifies setup for upgrades so if the current operator doesn't need to be changed, then it can be skipped, instead of having to specify the current operator again.
         if (operator_ != address(0)) {
             _transferOperatorship(operator_);
         }

contracts/governance/BaseWeightedMultisig.sol

@@ -107,6 +107,7 @@ abstract contract BaseWeightedMultisig is IBaseWeightedMultisig {
      * @param proof The multisig proof data
      * @return isLatestSigners True if the proof is from the latest signer set
      * @dev The proof data should have signers, weights, threshold and signatures encoded
+     *      The proof is only valid if the signers weight crosses the threshold and there are no redundant signatures
      *      The signers and signatures should be sorted by signer address in ascending order
      *      Example: abi.encode([0x11..., 0x22..., 0x33...], [1, 1, 1], 2, [signature1, signature3])
      */
@@ -216,8 +217,13 @@ abstract contract BaseWeightedMultisig is IBaseWeightedMultisig {
             // accumulating signatures weight
             totalWeight = totalWeight + signers[signerIndex].weight;
 
-            // weight needs to reach or surpass threshold
-            if (totalWeight >= weightedSigners.threshold) return;
+            // weight needs to reach threshold
+            if (totalWeight >= weightedSigners.threshold) {
+                // validate the proof if there are no redundant signatures
+                if (i + 1 == signaturesLength) return;
+
+                revert RedundantSignaturesProvided(i + 1, signaturesLength);
+            }
 
             // increasing signers index if match was found
             ++signerIndex;

contracts/interfaces/IBaseWeightedMultisig.sol

@@ -9,6 +9,7 @@ interface IBaseWeightedMultisig {
     error LowSignaturesWeight();
     error InvalidWeights();
     error DuplicateSigners(bytes32 signersHash);
+    error RedundantSignaturesProvided(uint256 required, uint256 provided);
     error InsufficientRotationDelay(uint256 minimumRotationDelay, uint256 lastRotationTimestamp, uint256 timeElapsed);
 
     event SignersRotated(uint256 indexed epoch, bytes32 indexed signersHash, bytes signers);

test/gateway/AxelarAmplifierGateway.js

@@ -212,6 +212,32 @@ describe('AxelarAmplifierGateway', () => {
             expect(await gateway.operator()).to.equal(operator.address);
         });
 
+        it('should allow deploying gateway with address 0 as the operator', async () => {
+            const signers = defaultAbiCoder.encode(
+                ['address', `${WEIGHTED_SIGNERS_TYPE}[]`],
+                [AddressZero, [weightedSigners]],
+            );
+
+            const implementation = await gatewayFactory.deploy(
+                previousSignersRetention,
+                domainSeparator,
+                minimumRotationDelay,
+            );
+            await implementation.deployTransaction.wait(network.config.confirmations);
+
+            const proxy = await gatewayProxyFactory.deploy(
+                implementation.address,
+                owner.address,
+                signers,
+                getGasOptions(),
+            );
+            await proxy.deployTransaction.wait(network.config.confirmations);
+
+            const gateway = gatewayFactory.attach(proxy.address);
+
+            expect(await gateway.operator()).to.equal(AddressZero);
+        });
+
         it('reject transferring ownership by non-owner', async () => {
             await expectRevert(
                 (gasOptions) => gateway.connect(operator).transferOwnership(operator.address, gasOptions),

test/governance/BaseWeightedMultisig.js

@@ -374,14 +374,6 @@ describe('BaseWeightedMultisig', () => {
                 await multisig.validateProofCall(dataHash, proof).then((tx) => tx.wait());
             });
 
-            it('validate the proof from the current signers with extra signatures', async () => {
-                // sign with all signers, i.e more than threshold
-                const proof = await getWeightedSignersProof(data, domainSeparator, weightedSigners, signers);
-
-                const isCurrentSigners = await multisig.validateProof(dataHash, proof);
-                expect(isCurrentSigners).to.be.true;
-            });
-
             it('validate the proof with last threshold signers', async () => {
                 const proof = await getWeightedSignersProof(
                     data,
@@ -481,6 +473,18 @@ describe('BaseWeightedMultisig', () => {
                     'LowSignaturesWeight',
                 );
             });
+
+            it('reject the proof if there are redundant signatures', async () => {
+                // sign with all signers, i.e more than threshold
+                const proof = await getWeightedSignersProof(data, domainSeparator, weightedSigners, signers);
+
+                await expectRevert(
+                    async (gasOptions) => multisig.validateProof(dataHash, proof),
+                    multisig,
+                    'RedundantSignaturesProvided',
+                    [signers.slice(0, threshold), proof.signatures.length],
+                );
+            });
         });
     });