Gnosis Safe Smart Contract Walkthrough

/**
 * @notice Internal method to create a new proxy contract using CREATE2. Optionally executes an initializer call to a new proxy.
 * @param _singleton Address of singleton contract. Must be deployed at the time of execution.
 * @param initializer (Optional) Payload for a message call to be sent to a new proxy contract.
 * @param salt Create2 salt to use for calculating the address of the new proxy contract.
 * @return proxy Address of the new proxy contract.
 */
function deployProxy(address _singleton, bytes memory initializer, bytes32 salt) internal returns (SafeProxy proxy) {
    require(isContract(_singleton), "Singleton contract not deployed");

    bytes memory deploymentData = abi.encodePacked(type(SafeProxy).creationCode, uint256(uint160(_singleton)));
    // solhint-disable-next-line no-inline-assembly
    assembly {
        proxy := create2(0x0, add(0x20, deploymentData), mload(deploymentData), salt)
    }
    require(address(proxy) != address(0), "Create2 call failed");

    if (initializer.length > 0) {
        // solhint-disable-next-line no-inline-assembly
        assembly {
            if eq(call(gas(), proxy, 0, add(initializer, 0x20), mload(initializer), 0, 0), 0) {
                revert(0, 0)
            }
        }
    }
}

/**
 * @notice Deploys a new proxy with `_singleton` singleton and `saltNonce` salt. Optionally executes an initializer call to a new proxy.
 * @param _singleton Address of singleton contract. Must be deployed at the time of execution.
 * @param initializer Payload for a message call to be sent to a new proxy contract.
 * @param saltNonce Nonce that will be used to generate the salt to calculate the address of the new proxy contract.
 */
function createProxyWithNonce(address _singleton, bytes memory initializer, uint256 saltNonce) public returns (SafeProxy proxy) {
    // If the initializer changes the proxy address should change too. Hashing the initializer data is cheaper than just concatinating it
    bytes32 salt = keccak256(abi.encodePacked(keccak256(initializer), saltNonce));
    proxy = deployProxy(_singleton, initializer, salt);
    emit ProxyCreation(proxy, _singleton);
}

contract SafeProxy {
    // Singleton always needs to be first declared variable, to ensure that it is at the same location in the contracts to which calls are delegated.
    // To reduce deployment costs this variable is internal and needs to be retrieved via `getStorageAt`
    address internal singleton;

    /**
     * @notice Constructor function sets address of singleton contract.
     * @param _singleton Singleton address.
     */
    constructor(address _singleton) {
        require(_singleton != address(0), "Invalid singleton address provided");
        singleton = _singleton;
    }

    /// @dev Fallback function forwards all transactions and returns all received return data.
    fallback() external payable {
        // solhint-disable-next-line no-inline-assembly
        assembly {
            let _singleton := and(sload(0), 0xffffffffffffffffffffffffffffffffffffffff)
            // 0xa619486e == keccak("masterCopy()"). The value is right padded to 32-bytes with 0s
            if eq(calldataload(0), 0xa619486e00000000000000000000000000000000000000000000000000000000) {
                mstore(0, _singleton)
                return(0, 0x20)
            }
            calldatacopy(0, 0, calldatasize())
            let success := delegatecall(gas(), _singleton, 0, calldatasize(), 0, 0)
            returndatacopy(0, 0, returndatasize())
            if eq(success, 0) {
                revert(0, returndatasize())
            }
            return(0, returndatasize())
        }
    }
}

/**
 * @notice Sets the initial storage of the contract.
 * @param _owners List of Safe owners.
 * @param _threshold Number of required confirmations for a Safe transaction.
 */
function setupOwners(address[] memory _owners, uint256 _threshold) internal {
    // Threshold can only be 0 at initialization.
    // Check ensures that setup function can only be called once.
    require(threshold == 0, "GS200");
    // Validate that threshold is smaller than number of added owners.
    require(_threshold <= _owners.length, "GS201");
    // There has to be at least one Safe owner.
    require(_threshold >= 1, "GS202");
    // Initializing Safe owners.
    address currentOwner = SENTINEL_OWNERS;
    for (uint256 i = 0; i < _owners.length; i++) {
        // Owner address cannot be null.
        address owner = _owners[i];
        require(owner != address(0) && owner != SENTINEL_OWNERS && owner != address(this) && currentOwner != owner, "GS203");
        // No duplicate owners allowed.
        require(owners[owner] == address(0), "GS204");
        owners[currentOwner] = owner;
        currentOwner = owner;
    }
    owners[currentOwner] = SENTINEL_OWNERS;
    ownerCount = _owners.length;
    threshold = _threshold;
}
...
/**
 * @notice Removes the owner `owner` from the Safe and updates the threshold to `_threshold`.
 * @dev This can only be done via a Safe transaction.
 * @param prevOwner Owner that pointed to the owner to be removed in the linked list
 * @param owner Owner address to be removed.
 * @param _threshold New threshold.
 */
function removeOwner(address prevOwner, address owner, uint256 _threshold) public authorized {
    // Only allow to remove an owner, if threshold can still be reached.
    require(ownerCount - 1 >= _threshold, "GS201");
    // Validate owner address and check that it corresponds to owner index.
    require(owner != address(0) && owner != SENTINEL_OWNERS, "GS203");
    require(owners[prevOwner] == owner, "GS205");
    owners[prevOwner] = owners[owner];
    owners[owner] = address(0);
    ownerCount--;
    emit RemovedOwner(owner);
    // Change threshold if threshold was changed.
    if (threshold != _threshold) changeThreshold(_threshold);
}

/**
 * @notice Setup function sets the initial storage of the contract.
 *         Optionally executes a delegate call to another contract to setup the modules.
 * @param to Optional destination address of call to execute.
 * @param data Optional data of call to execute.
 */
function setupModules(address to, bytes memory data) internal {
    require(modules[SENTINEL_MODULES] == address(0), "GS100");
    modules[SENTINEL_MODULES] = SENTINEL_MODULES;
    if (to != address(0)) {
        require(isContract(to), "GS002");
        // Setup has to complete successfully or transaction fails.
        require(execute(to, 0, data, Enum.Operation.DelegateCall, type(uint256).max), "GS000");
    }
}

abstract contract SelfAuthorized {
    function requireSelfCall() private view {
        require(msg.sender == address(this), "GS031");
    }

    modifier authorized() {
        // Modifiers are copied around during compilation. This is a function call as it minimized the bytecode size
        requireSelfCall();
        _;
    }
}

/**
 * @dev Set a guard that checks transactions before execution
 *      This can only be done via a Safe transaction.
 *      ⚠️ IMPORTANT: Since a guard has full power to block Safe transaction execution,
 *        a broken guard can cause a denial of service for the Safe. Make sure to carefully
 *        audit the guard code and design recovery mechanisms.
 * @notice Set Transaction Guard `guard` for the Safe. Make sure you trust the guard.
 * @param guard The address of the guard to be used or the 0 address to disable the guard
 */
function setGuard(address guard) external authorized {
    if (guard != address(0)) {
        require(Guard(guard).supportsInterface(type(Guard).interfaceId), "GS300");
    }
    bytes32 slot = GUARD_STORAGE_SLOT;
    // solhint-disable-next-line no-inline-assembly
    assembly {
        sstore(slot, guard)
    }
    emit ChangedGuard(guard);
}

/**
 * @dev Internal method to retrieve the current guard
 *      We do not have a public method because we're short on bytecode size limit,
 *      to retrieve the guard address, one can use `getStorageAt` from `StorageAccessible` contract
 *      with the slot `GUARD_STORAGE_SLOT`
 * @return guard The address of the guard
 */
function getGuard() internal view returns (address guard) {
    bytes32 slot = GUARD_STORAGE_SLOT;
    // solhint-disable-next-line no-inline-assembly
    assembly {
        guard := sload(slot)
    }
}

abstract contract FallbackManager is SelfAuthorized {
    event ChangedFallbackHandler(address indexed handler);

    // keccak256("fallback_manager.handler.address")
    bytes32 internal constant FALLBACK_HANDLER_STORAGE_SLOT = 0x6c9a6c4a39284e37ed1cf53d337577d14212a4870fb976a4366c693b939918d5;

    /**
     *  @notice Internal function to set the fallback handler.
     *  @param handler contract to handle fallback calls.
     */
    function internalSetFallbackHandler(address handler) internal {
        /*
            If a fallback handler is set to self, then the following attack vector is opened:
            Imagine we have a function like this:
            function withdraw() internal authorized {
                withdrawalAddress.call.value(address(this).balance)("");
            }

            If the fallback method is triggered, the fallback handler appends the msg.sender address to the calldata and calls the fallback handler.
            A potential attacker could call a Safe with the 3 bytes signature of a withdraw function. Since 3 bytes do not create a valid signature,
            the call would end in a fallback handler. Since it appends the msg.sender address to the calldata, the attacker could craft an address 
            where the first 3 bytes of the previous calldata + the first byte of the address make up a valid function signature. The subsequent call would result in unsanctioned access to Safe's internal protected methods.
            For some reason, solidity matches the first 4 bytes of the calldata to a function signature, regardless if more data follow these 4 bytes.
        */
        require(handler != address(this), "GS400");

        bytes32 slot = FALLBACK_HANDLER_STORAGE_SLOT;
        // solhint-disable-next-line no-inline-assembly
        assembly {
            sstore(slot, handler)
        }
    }

    /**
     * @notice Set Fallback Handler to `handler` for the Safe.
     * @dev Only fallback calls without value and with data will be forwarded.
     *      This can only be done via a Safe transaction.
     *      Cannot be set to the Safe itself.
     * @param handler contract to handle fallback calls.
     */
    function setFallbackHandler(address handler) public authorized {
        internalSetFallbackHandler(handler);
        emit ChangedFallbackHandler(handler);
    }

    // @notice Forwards all calls to the fallback handler if set. Returns 0 if no handler is set.
    // @dev Appends the non-padded caller address to the calldata to be optionally used in the handler
    //      The handler can make us of `HandlerContext.sol` to extract the address.
    //      This is done because in the next call frame the `msg.sender` will be FallbackManager's address
    //      and having the original caller address may enable additional verification scenarios.
    // solhint-disable-next-line payable-fallback,no-complex-fallback
    fallback() external {
        bytes32 slot = FALLBACK_HANDLER_STORAGE_SLOT;
        // solhint-disable-next-line no-inline-assembly
        assembly {
            let handler := sload(slot)
            if iszero(handler) {
                return(0, 0)
            }
            calldatacopy(0, 0, calldatasize())
            // The msg.sender address is shifted to the left by 12 bytes to remove the padding
            // Then the address without padding is stored right after the calldata
            mstore(calldatasize(), shl(96, caller()))
            // Add 20 bytes for the address appended add the end
            let success := call(gas(), handler, 0, 0, add(calldatasize(), 20), 0, 0)
            returndatacopy(0, 0, returndatasize())
            if iszero(success) {
                revert(0, returndatasize())
            }
            return(0, returndatasize())
        }
    }
}

/** @notice Executes a `operation` {0: Call, 1: DelegateCall}} transaction to `to` with `value` (Native Currency)
 *          and pays `gasPrice` * `gasLimit` in `gasToken` token to `refundReceiver`.
 * @dev The fees are always transferred, even if the user transaction fails.
 *      This method doesn't perform any sanity check of the transaction, such as:
 *      - if the contract at `to` address has code or not
 *      - if the `gasToken` is a contract or not
 *      It is the responsibility of the caller to perform such checks.
 * @param to Destination address of Safe transaction.
 * @param value Ether value of Safe transaction.
 * @param data Data payload of Safe transaction.
 * @param operation Operation type of Safe transaction.
 * @param safeTxGas Gas that should be used for the Safe transaction.
 * @param baseGas Gas costs that are independent of the transaction execution(e.g. base transaction fee, signature check, payment of the refund)
 * @param gasPrice Gas price that should be used for the payment calculation.
 * @param gasToken Token address (or 0 if ETH) that is used for the payment.
 * @param refundReceiver Address of receiver of gas payment (or 0 if tx.origin).
 * @param signatures Signature data that should be verified.
 *                   Can be packed ECDSA signature ({bytes32 r}{bytes32 s}{uint8 v}), contract signature (EIP-1271) or approved hash.
 * @return success Boolean indicating transaction's success.
 */
function execTransaction(
    address to,
    uint256 value,
    bytes calldata data,
    Enum.Operation operation,
    uint256 safeTxGas,
    uint256 baseGas,
    uint256 gasPrice,
    address gasToken,
    address payable refundReceiver,
    bytes memory signatures
) public payable virtual returns (bool success) {
    bytes32 txHash;
    // Use scope here to limit variable lifetime and prevent `stack too deep` errors
    {
        bytes memory txHashData = encodeTransactionData(
            // Transaction info
            to,
            value,
            data,
            operation,
            safeTxGas,
            // Payment info
            baseGas,
            gasPrice,
            gasToken,
            refundReceiver,
            // Signature info
            nonce
        );
        // Increase nonce and execute transaction.
        nonce++;
        txHash = keccak256(txHashData);
        checkSignatures(txHash, txHashData, signatures);
    }
    address guard = getGuard();
    {
        if (guard != address(0)) {
            Guard(guard).checkTransaction(
                // Transaction info
                to,
                value,
                data,
                operation,
                safeTxGas,
                // Payment info
                baseGas,
                gasPrice,
                gasToken,
                refundReceiver,
                // Signature info
                signatures,
                msg.sender
            );
        }
    }
    // We require some gas to emit the events (at least 2500) after the execution and some to perform code until the execution (500)
    // We also include the 1/64 in the check that is not send along with a call to counteract potential shortings because of EIP-150
    require(gasleft() >= ((safeTxGas * 64) / 63).max(safeTxGas + 2500) + 500, "GS010");
    // Use scope here to limit variable lifetime and prevent `stack too deep` errors
    {
        uint256 gasUsed = gasleft();
        // If the gasPrice is 0 we assume that nearly all available gas can be used (it is always more than safeTxGas)
        // We only substract 2500 (compared to the 3000 before) to ensure that the amount passed is still higher than safeTxGas
        success = execute(to, value, data, operation, gasPrice == 0 ? (gasleft() - 2500) : safeTxGas);
        gasUsed = gasUsed.sub(gasleft());
        // If no safeTxGas and no gasPrice was set (e.g. both are 0), then the internal tx is required to be successful
        // This makes it possible to use `estimateGas` without issues, as it searches for the minimum gas where the tx doesn't revert
        require(success || safeTxGas != 0 || gasPrice != 0, "GS013");
        // We transfer the calculated tx costs to the tx.origin to avoid sending it to intermediate contracts that have made calls
        uint256 payment = 0;
        if (gasPrice > 0) {
            payment = handlePayment(gasUsed, baseGas, gasPrice, gasToken, refundReceiver);
        }
        if (success) emit ExecutionSuccess(txHash, payment);
        else emit ExecutionFailure(txHash, payment);
    }
    {
        if (guard != address(0)) {
            Guard(guard).checkAfterExecution(txHash, success);
        }
    }
}

/**
 * @notice Execute `operation` (0: Call, 1: DelegateCall) to `to` with `value` (Native Token)
 * @dev Function is virtual to allow overriding for L2 singleton to emit an event for indexing.
 * @param to Destination address of module transaction.
 * @param value Ether value of module transaction.
 * @param data Data payload of module transaction.
 * @param operation Operation type of module transaction.
 * @return success Boolean flag indicating if the call succeeded.
 */
function execTransactionFromModule(
    address to,
    uint256 value,
    bytes memory data,
    Enum.Operation operation
) public virtual returns (bool success) {
    // Only whitelisted modules are allowed.
    require(msg.sender != SENTINEL_MODULES && modules[msg.sender] != address(0), "GS104");
    // Execute transaction without further confirmations.
    success = execute(to, value, data, operation, type(uint256).max);
    if (success) emit ExecutionFromModuleSuccess(msg.sender);
    else emit ExecutionFromModuleFailure(msg.sender);
}

/**
 * @notice Handles the payment for a Safe transaction.
 * @param gasUsed Gas used by the Safe transaction.
 * @param baseGas Gas costs that are independent of the transaction execution (e.g. base transaction fee, signature check, payment of the refund).
 * @param gasPrice Gas price that should be used for the payment calculation.
 * @param gasToken Token address (or 0 if ETH) that is used for the payment.
 * @return payment The amount of payment made in the specified token.
 */
function handlePayment(
    uint256 gasUsed,
    uint256 baseGas,
    uint256 gasPrice,
    address gasToken,
    address payable refundReceiver
) private returns (uint256 payment) {
    // solhint-disable-next-line avoid-tx-origin
    address payable receiver = refundReceiver == address(0) ? payable(tx.origin) : refundReceiver;
    if (gasToken == address(0)) {
        // For ETH we will only adjust the gas price to not be higher than the actual used gas price
        payment = gasUsed.add(baseGas).mul(gasPrice < tx.gasprice ? gasPrice : tx.gasprice);
        require(receiver.send(payment), "GS011");
    } else {
        payment = gasUsed.add(baseGas).mul(gasPrice);
        require(transferToken(gasToken, receiver, payment), "GS012");
    }
}

/**
 * @notice Checks whether the signature provided is valid for the provided data and hash. Reverts otherwise.
 * @dev Since the EIP-1271 does an external call, be mindful of reentrancy attacks.
 * @param dataHash Hash of the data (could be either a message hash or transaction hash)
 * @param data That should be signed (this is passed to an external validator contract)
 * @param signatures Signature data that should be verified.
 *                   Can be packed ECDSA signature ({bytes32 r}{bytes32 s}{uint8 v}), contract signature (EIP-1271) or approved hash.
 * @param requiredSignatures Amount of required valid signatures.
 */
function checkNSignatures(bytes32 dataHash, bytes memory data, bytes memory signatures, uint256 requiredSignatures) public view {
    // Check that the provided signature data is not too short
    require(signatures.length >= requiredSignatures.mul(65), "GS020");
    // There cannot be an owner with address 0.
    address lastOwner = address(0);
    address currentOwner;
    uint8 v;
    bytes32 r;
    bytes32 s;
    uint256 i;
    for (i = 0; i < requiredSignatures; i++) {
        (v, r, s) = signatureSplit(signatures, i);
        if (v == 0) {
            require(keccak256(data) == dataHash, "GS027");
            // If v is 0 then it is a contract signature
            // When handling contract signatures the address of the contract is encoded into r
            currentOwner = address(uint160(uint256(r)));

            // Check that signature data pointer (s) is not pointing inside the static part of the signatures bytes
            // This check is not completely accurate, since it is possible that more signatures than the threshold are send.
            // Here we only check that the pointer is not pointing inside the part that is being processed
            require(uint256(s) >= requiredSignatures.mul(65), "GS021");

            // Check that signature data pointer (s) is in bounds (points to the length of data -> 32 bytes)
            require(uint256(s).add(32) <= signatures.length, "GS022");

            // Check if the contract signature is in bounds: start of data is s + 32 and end is start + signature length
            uint256 contractSignatureLen;
            // solhint-disable-next-line no-inline-assembly
            assembly {
                contractSignatureLen := mload(add(add(signatures, s), 0x20))
            }
            require(uint256(s).add(32).add(contractSignatureLen) <= signatures.length, "GS023");

            // Check signature
            bytes memory contractSignature;
            // solhint-disable-next-line no-inline-assembly
            assembly {
                // The signature data for contract signatures is appended to the concatenated signatures and the offset is stored in s
                contractSignature := add(add(signatures, s), 0x20)
            }
            require(ISignatureValidator(currentOwner).isValidSignature(data, contractSignature) == EIP1271_MAGIC_VALUE, "GS024");
        } else if (v == 1) {
            // If v is 1 then it is an approved hash
            // When handling approved hashes the address of the approver is encoded into r
            currentOwner = address(uint160(uint256(r)));
            // Hashes are automatically approved by the sender of the message or when they have been pre-approved via a separate transaction
            require(msg.sender == currentOwner || approvedHashes[currentOwner][dataHash] != 0, "GS025");
        } else if (v > 30) {
            // If v > 30 then default va (27,28) has been adjusted for eth_sign flow
            // To support eth_sign and similar we adjust v and hash the messageHash with the Ethereum message prefix before applying ecrecover
            currentOwner = ecrecover(keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", dataHash)), v - 4, r, s);
        } else {
            // Default is the ecrecover flow with the provided data hash
            // Use ecrecover with the messageHash for EOA signatures
            currentOwner = ecrecover(dataHash, v, r, s);
        }
        require(currentOwner > lastOwner && owners[currentOwner] != address(0) && currentOwner != SENTINEL_OWNERS, "GS026");
        lastOwner = currentOwner;
    }
}

/**
 * @notice Marks hash `hashToApprove` as approved.
 * @dev This can be used with a pre-approved hash transaction signature.
 *      IMPORTANT: The approved hash stays approved forever. There's no revocation mechanism, so it behaves similarly to ECDSA signatures
 * @param hashToApprove The hash to mark as approved for signatures that are verified by this contract.
 */
function approveHash(bytes32 hashToApprove) external {
    require(owners[msg.sender] != address(0), "GS030");
    approvedHashes[msg.sender][hashToApprove] = 1;
    emit ApproveHash(hashToApprove, msg.sender);
}