Critical Invariants (at a glance)

• [ ] No module, function, or guard can execute privileged actions (owner/threshold changes) without multisig consensus.
• [ ] All state mutations must be finalized before event emission.

Threshold

• [ ] 1 < threshold ≤ ownerCount always.
• [ ] revalidate threshold after signer set changes.
• [ ] Check threshold at execution time also.

Nonce

• [ ] Nonce is consumed atomically, and strictly increasing.
• [ ] Executed transactions cannot be replayed.

Signer Set

• [ ] No address can appear twice in the active signer set.
• [ ] No address(0) as signers.
• [ ] Updating signer list requires a quorum.

Signatures

• [ ] Signed hash follows EIP712, uses dynamic chainId, contract address

Execution

• [ ] Batch execution is atomic.
• [ ] txHash marked executed = true is permanently immutable.
• [ ] Gas refundReceiver must be checked to avoid ETH drain.