High control weakness in Governance.sol

Description

The affected control does not preserve its security invariant across every reachable state transition.

Impact

An attacker can violate accounting assumptions and put user funds at risk.

Proof of concept

1. Prepare the boundary state.
2. Call the affected entry point.
3. Observe the invariant break.

Recommended mitigations

Enforce the invariant at the state-transition boundary and add a regression test for the adversarial path.