What Your Multisig Threshold Actually Protects

I've been digging into multisig configurations for bridge and protocol security reviews. The threshold gets all the attention — 3-of-5, 4-of-7, whatever. But after checking a few dozen Safes on mainnet, the threshold is rarely the weakest link. There are five other things that determine whether a Gnosis Safe actually protects funds, and most people only check the first one. This post walks through all of them, with cast commands you can run yourself. What the threshold does The threshold sets the minimum number of owner signatures required to execute a transaction through execTransaction() . If threshold is 3 and you have 2 signatures, the call reverts. Simple. # check threshold and owners cast call <SAFE> "getThreshold()(uint256)" cast call <SAFE> "getOwners()(address[])" This is the part everyone understlse. What the threshold does NOT protect 1. Modules This is the biggest blind spot in multisig security. Safe modules are contracts authorFromModule()`. A module can execute*any transaction from the safe without a single owner signature*. The threshold is irrelevant. The module has its own authority. `bash if this returns anything other than an empty array, investigate cast call "getModulesPagin[],address)" \ 0x0000000000000000000000000000000000000001 10 ` Modules are legitimate — timelockation. But a malicious or compromisedmodule is a full bypass of every threshold. Your 7-of-10 means nothing if a module can move funds independently. 2. Guard A guard contract implements checerExecution() . It adds validation on top of the threshold — restricting destinations, limiting values, blocking certain operations. The guard address lives at a specific storage slot. If it's 0x00 , there's no guard. No additional checks beyond threshold + signatu `bash guard storage slot (keccak256("guard_manager.guard.address")) cast storage \ 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8 0x000...000 = no guard installe ` A guard can enforce things like "no transfers ab