The upgrade deployment script failed to call an important initialization function, leaving the vote threshold at zero and allowing anyone to withdraw ‘without signature.’