Multi-Sig Upgrade Backdoors: Governance Control Risks in On-Chain Upgrade Mechanisms

Multi-signature (multi-sig) governance is widely marketed as a decentralization and trust-minimization mechanism in blockchain systems. However, when upgrade authority is concentrated among a small set of signers, multi-sig governance often functions as a latent backdoor, enabling unilateral or collusive control over protocol logic, validator rules, and asset management. This paper analyzes the structural preconditions, attack vectors, and systemic risks associated with upgradeable multi-sig mechanisms. We also propose mitigation strategies for bounding authority and enhancing accountability in on-chain governance.