Signers can bypass checks and change threshold within a transaction
The `checkAfterExecution()` function has checks to ensure that the safe's threshold isn't changed by a transaction executed by signers. However, the parameters used by the check can be changed midflight so that this crucial restriction is violated.\\nThe `checkAfterExecution()` is intended to uphold important invariants after each signer transaction is completed. This is intended to restrict certain dangerous signer behaviors. From the docs:\\n/// @notice Post-flight check to prevent `safe` signers from removing this contract guard, changing any modules, or changing the threshold\\nHowever, the restriction that the signers cannot change the threshold can be violated.\\nTo see how this is possible, let's check how this invariant is upheld. The following check is performed within the function:\\n```\\nif (safe.getThreshold() != _getCorrectThreshold()) {\\n    revert SignersCannotChangeThreshold();\\n}\\n```\\n\\nIf we look up `_getCorrectThreshold()`, we see the following:\\n```\\nfunction _getCorrectThreshold() internal view returns (uint256 _threshold) {\\n    uint256 count = _countValidSigners(safe.getOwners());\\n    uint256 min = minThreshold;\\n    uint256 max = targetThreshold;\\n    if (count < min) _threshold = min;\\n    else if (count > max) _threshold = max;\\n    else _threshold = count;\\n}\\n```\\n\\nAs we can see, this means that the safe's threshold after the transaction must equal the valid signers, bounded by the `minThreshold` and `maxThreshold`.\\nHowever, this check does not ensure that the value returned by `_getCorrectThreshold()` is the same before and after the transaction. As a result, as long as the number of owners is also changed in the transaction, the condition can be upheld.\\nTo illustrate, let's look at an example:\\nBefore the transaction, there are 8 owners on the vault, all signers. targetThreshold == 10 and minThreshold == 2, so the safe's threshold is 8 and everything is good.\\nThe transaction calls `removeOwner()`, removing an owner from the safe and adjusting the threshold down to 7.\\nAfter the transaction, there will be 7 owners on the vault, all signers, the safe's threshold will be 7, and the check will pass.\\nThis simple example focuses on using `removeOwner()` once to decrease the threshold. However, it is also possible to use the safe's multicall functionality to call `removeOwner()` multiple times, changing the threshold more dramatically.
Save the safe's current threshold in `checkTransaction()` before the transaction has executed, and compare the value after the transaction to that value from storage.
Signers can change the threshold of the vault, giving themselves increased control over future transactions and breaking an important trust assumption of the protocol.
```\\nif (safe.getThreshold() != _getCorrectThreshold()) {\\n    revert SignersCannotChangeThreshold();\\n}\\n```\\n