TRANSACTION EXECUTION IS `DoS` IN THE CROSS-CHAIN GOVERNANCE CONTRACTS AND IN THE GNOSIS SAFE COMMUNITY MULTISIG TRANSACTION CHECKS SINCE THE WRONG `payload` IS EXTRACTED FROM THE `data` BYTES ARRAY
Audit: 2023-12-autonolas-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-12-autonolas/blob/main/governance/contracts/multisigs/GuardCM.sol#L212-L223
https://github.com/code-423n4/2023-12-autonolas/blob/main/governance/contracts/multisigs/GuardCM.sol#L236-L241
https://github.com/code-423n4/2023-12-autonolas/blob/main/governance/contracts/multisigs/GuardCM.sol#L192-L200
https://github.com/code-423n4/2023-12-autonolas/blob/main/governance/contracts/bridges/HomeMediator.sol#L152-L163
https://github.com/code-423n4/2023-12-autonolas/blob/main/governance/contracts/bridges/FxGovernorTunnel.sol#L152-L163


# Vulnerability details

## Impact

The `GuardCM._verifyBridgedData` function is used to verify the bridged data for authorized combinations of targets and selectors in the Gnosis Safe community multisig. 

The `data` payload is passed into the `_verifyBridgedData` function which is then unpacked inside the `for` loop by iterating through the bytes of the `data` payload. The `for` loop index `i` is updated accordingly to extract the relevant piece of data from the `data` payload bytes array as shown below:

        for (uint256 i = 0; i < data.length;) {
            address target;
            uint32 payloadLength;
            // solhint-disable-next-line no-inline-assembly
            assembly {
                // First 20 bytes is the address (160 bits)
                i := add(i, 20) //@audit-info - increase the index i by 20
                target := mload(add(data, i)) //@audit-info - load the data from 20-51 (32 bytes word). Here the last 20 bytes is the target address (the most significant 12 bytes are truncated)
                // Offset the data by 12 bytes of value (96 bits) and by 4 bytes of payload length (32 bits)
                i := add(i, 16) //@audit-info - now the i is 20 + 16 = 36.
                payloadLength := mload(add(data, i)) //@audit-info - load the data from 36-67 (32 bytes word). Here the last 28 bytes is the payload length (the most significant 4 bytes are truncated)
            }

            ...
            ...
        }

As it is evident from the above code snippet the `i` is increased by `20` and then the `target` address is extracted from `data` bytes array (target = data[32:51]). Then the `i` is increased by `16` and then the `payloadLength` is extracted from the `data` bytes array (payloadLength = data[64:67]). As of now the updated value of `i` is `36` since it has been added 20 and 16 respectively.

Then data validation checks are performed for the `target` address and the `payloadLength` values. After that the actual `bytes payload` is extracted from the `data` bytes array as shown below:

            bytes memory payload = new bytes(payloadLength); //@audit-info - payload length is the length of the data of the newly created bytes array for the payload being extracted
            for (uint256 j = 0; j < payloadLength; ++j) {
                payload[j] = data[i + j]; //@audit-issue - payload should start from 68th byte onwards. Not f