# If signer gate is deployed to safe with more than 5 existing modules, safe will be bricked

HatsSignerGate attached to a Safe with >5 modules miscounts enabledModuleCount, causing every subsequent transaction to revert and bricking the Safe.

- Payout: Contest reward
- Severity: medium
- Program: Hats
- Credited: cducrest-brainbot
- Disclosed: 2023-02-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-hats-judging/issues/43
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-hats%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:misconfiguration

**Target:** HatsSignerGateFactory / Gnosis Safe module integration
**Root cause:** getModulesPaginated(SENTINEL_MODULES, 5) caps results at 5, so enabledModuleCount is set to 6 regardless of the real module count; post-transaction check with enabledModuleCount+1 then sees a different module set and reverts.
**Steps:**
1. Deploy HatsSignerGate to an existing Safe that already has >5 modules via `deployHatsSignerGate(...)`
2. Factory calls `getModulesPaginated(SENTINEL_MODULES, 5)` returning only 5 modules, setting `enabledModuleCount = 6`
3. Any signer submits a transaction; `checkTransaction()` hashes first 6 modules into `_existingModulesHash`
4. After execution, `getModulesPaginated(SENTINEL_OWNERS, enabledModuleCount + 1)` returns 7 modules; hash mismatch triggers `revert SignersCannotChangeModules()`
5. All future Safe transactions revert permanently
**How found:** Code review of the factory's paginated module fetch; noticed the hardcoded page size of 5 versus the later check using enabledModuleCount+1, and that the limitation was only documented in a comment rather than enforced.
**Insight:** When a contract reads a paginated list with a fixed page size to derive a count, compare against a page size of N+1 to detect truncation; comments documenting preconditions are not enforcement.