Safe can be bricked because threshold is updated with validSignerCount instead of newThreshold
The safe's threshold is supposed to be set with the lower value of the `validSignerCount` and the `targetThreshold` (intended to serve as the maximum). However, the wrong value is used in the call to the safe's function, which in some circumstances can lead to the safe being permanently bricked.\\nIn `reconcileSignerCount()`, the valid signer count is calculated. We then create a value called `newThreshold`, and set it to the minimum of the valid signer count and the target threshold. This is intended to be the value that we update the safe's threshold with.\\n```\\nif (validSignerCount <= target && validSignerCount != currentThreshold) {\\n    newThreshold = validSignerCount;\\n} else if (validSignerCount > target && currentThreshold < target) {\\n    newThreshold = target;\\n}\\n```\\n\\nHowever, there is a typo in the contract call, which accidentally uses `validSignerCount` instead of `newThreshold`.\\nThe result is that, if there are more valid signers than the `targetThreshold` that was set, the threshold will be set higher than intended, and the threshold check in `checkAfterExecution()` will fail for being above the max, causing all safe transactions to revert.\\nThis is a major problem because it cannot necessarily be fixed. In the event that it is a gate with a single hat signer, and the eligibility module for the hat doesn't have a way to turn off eligibility, there will be no way to reduce the number of signers. If this number is greater than `maxSigners`, there is no way to increase `targetThreshold` sufficiently to stop the reverting.\\nThe result is that the safe is permanently bricked, and will not be able to perform any transactions.
Issue Safe can be bricked because threshold is updated with validSignerCount instead of newThreshold\\nChange the value in the function call from `validSignerCount` to `newThreshold`.\\n```\\nif (newThreshold > 0) {\\n// Remove the line below\\n    bytes memory data = abi.encodeWithSignature("changeThreshold(uint256)", validSignerCount);\\n// Add the line below\\n    bytes memory data = abi.encodeWithSignature("changeThreshold(uint256)", newThreshold);\\n\\n    bool success = safe.execTransactionFromModule(\\n        address(safe), // to\\n        0, // value\\n        data, // data\\n        Enum.Operation.Call // operation\\n    );\\n\\n    if (!success) {\\n        revert FailedExecChangeThreshold();\\n    }\\n}\\n```\\n
All transactions will revert until `validSignerCount` can be reduced back below `targetThreshold`, which re
```\\nif (validSignerCount <= target && validSignerCount != currentThreshold) {\\n    newThreshold = validSignerCount;\\n} else if (validSignerCount > target && currentThreshold < target) {\\n    newThreshold = target;\\n}\\n```\\n