fix(governance): add check for strict Multisig threshold validation

contracts/governance/BaseWeightedMultisig.sol

@@ -216,8 +216,13 @@ abstract contract BaseWeightedMultisig is IBaseWeightedMultisig {
             // accumulating signatures weight
             totalWeight = totalWeight + signers[signerIndex].weight;
 
-            // weight needs to reach or surpass threshold
-            if (totalWeight >= weightedSigners.threshold) return;
+            // weight needs to reach threshold
+            if (totalWeight >= weightedSigners.threshold) {
+                // check if number of signatures exceed required amount of signatures
+                if (signaturesLength - 1 != i) revert InvalidSignaturesLength(signaturesLength, i + 1);
+
+                return;
+            }
 
             // increasing signers index if match was found
             ++signerIndex;

contracts/interfaces/IBaseWeightedMultisig.sol

@@ -9,6 +9,7 @@ interface IBaseWeightedMultisig {
     error LowSignaturesWeight();
     error InvalidWeights();
     error DuplicateSigners(bytes32 signersHash);
+    error InvalidSignaturesLength(uint256 provided, uint256 required);
     error InsufficientRotationDelay(uint256 minimumRotationDelay, uint256 lastRotationTimestamp, uint256 timeElapsed);
 
     event SignersRotated(uint256 indexed epoch, bytes32 indexed signersHash, bytes signers);

test/governance/BaseWeightedMultisig.js

@@ -374,14 +374,6 @@ describe('BaseWeightedMultisig', () => {
                 await multisig.validateProofCall(dataHash, proof).then((tx) => tx.wait());
             });
 
-            it('validate the proof from the current signers with extra signatures', async () => {
-                // sign with all signers, i.e more than threshold
-                const proof = await getWeightedSignersProof(data, domainSeparator, weightedSigners, signers);
-
-                const isCurrentSigners = await multisig.validateProof(dataHash, proof);
-                expect(isCurrentSigners).to.be.true;
-            });
-
             it('validate the proof with last threshold signers', async () => {
                 const proof = await getWeightedSignersProof(
                     data,
@@ -481,6 +473,18 @@ describe('BaseWeightedMultisig', () => {
                     'LowSignaturesWeight',
                 );
             });
+
+            it('reject the proof if number of total signatures exceed required signatures', async () => {
+                // sign with all signers, i.e more than threshold
+                const proof = await getWeightedSignersProof(data, domainSeparator, weightedSigners, signers);
+
+                await expectRevert(
+                    async (gasOptions) => multisig.validateProof(dataHash, proof),
+                    multisig,
+                    'InvalidSignaturesLength',
+                    [proof.signatures.length, signers.slice(0, threshold)],
+                );
+            });
         });
     });