Vulnerability: Changing the owners or required confirmations in the AssetProxyOwner can unconfirm a previously confirmed transaction
Severity: medium

Description:
Once a transaction has been confirmed in the `AssetProxyOwner`, it cannot be executed until a lock period has passed. During that time, any change to the number of required confirmations will cause this transaction to no longer be executable.\\nIf the number of required confirmations was decreased, then one or more owners will have to revoke their confirmation before the transaction can be executed.\\nIf the number of required confirmations was increased, then additional owners will have to confirm the transaction, and when the new required number of confirmations is reached, a new confirmation time will be recorded, and thus the time lock will restart.\\nSimilarly, if an owner that had previously confirmed the transaction is replaced, the number of confirmations will drop for existing transactions, and they will need to be confirmed again.\\nThis is not disastrous, but it's almost certainly unintended behavior and may make it difficult to make changes to the multisig owners and parameters.\\n`executeTransaction()` requires that at the time of execution, the transaction is confirmed:\\n```\\nfunction executeTransaction(uint256 transactionId)\\n    public\\n    notExecuted(transactionId)\\n    fullyConfirmed(transactionId)\\n```\\n\\n`isConfirmed()` checks for exact equality with the number of required confirmations. Having too many confirmations is just as bad as too few:\\n```\\n/// @dev Returns the confirmation status of a transaction.\\n/// @param transactionId Transaction ID.\\n/// @return Confirmation status.\\nfunction isConfirmed(uint256 transactionId)\\n    public\\n    view\\n    returns (bool)\\n{\\n    uint256 count = 0;\\n    for (uint256 i = 0; i < owners.length; i++) {\\n        if (confirmations[transactionId][owners[i]]) {\\n            count += 1;\\n        }\\n        if (count == required) {\\n            return true;\\n        }\\n    }\\n}\\n```\\n\\nIf additional confirmations are required to reconfirm a transaction, that resets the time lock:\\n```\\n/// @dev Allows an owner to confirm a transaction.\\n/// @param transactionId Transaction ID.\\nfunction confirmTransaction(uint256 transactionId)\\n    public\\n    ownerExists(msg.sender)\\n    transactionExists(transactionId)\\n    notConfirmed(transactionId, msg.sender)\\n    notFullyConfirmed(transactionId)\\n{\\n    confirmations[transactionId][msg.sender] = true;\\n    emit Confirmation(msg.sender, transactionId);\\n    if (isConfirmed(transactionId)) {\\n        \\_setConfirmationTime(transactionId, block.timestamp);\\n    }\\n}\\n```\\n

Impact:

Recommended mitigation:
As in https://github.com/ConsenSys/0x-v3-audit-2019-09/issues/39, the semantics of the original `MultiSigWallet` were that once a transaction is fully confirmed, it's immediately executed. The time lock means this is no longer possible, but it is possible to record that the transaction is confirmed and never allow this to change. In fact, the confirmation time already records this. Once the confirmation time is non-zero, a transaction should always be considered confirmed.