https://hackmd.io/@idegen/E8-Audius-Gets-Owned
7/29/2022 - I, Degen - E8 - Audius Governance Attacked
:::info
Follow--> @idegenfm
:::
:::success
Listen---> https://idegen.fm
:::
Intro
Welcome to I, Degen - Each week, we track down and explore the most exciting crypto stories. Hacks, mysteries, exploits, and anything that feeds our crypto curiosity.
Welcome degens! Come one, come all.
Episode Summary
This week we explore the Audius governance attack.
I, Degen - Weekly
funds were transferred from Nguyen’s wallet so that AXS short sellers “would not be able to front-run the news,”
- US Senators Push Bill to Make Small Crypto Transactions Tax-Free under $50 - From Coindesk
- FBI detects fake crypto apps that scammed $42.7M from 244 victims - From Cryptoslate
- South Korean officials conclude week-long raid in Terra-LUNA case
- The recent swoon in cryptocurrency valuations “has directly impacted pricing of luxury watches from brands like Rolex and Patek Philippe,” - From Bloomberg
Deep Dive - Audius Governance Attack
What happened?
On July 23rd, 2022, Audius, a Web3 music platform, suffered a governance attack for $6M worth of AUDIO, it's native token.
What is Audius?
Before we jump in lets talk about what proxy contracts are and how they work.
Proxy contracts give the ability to upgrade or change a dapps contract logic, or even deploy clones.
High level, in this case (but not all proxy patterns), they separate the storage and logic layers of the app, where the proxy contract sits in front and handles storage, and another contract sits behind the proxy and handles the application logic.
source: https://blog.openzeppelin.com/proxy-patterns/
Key Point:
Whenever a contract A delegates a call to another contract B, it executes the code of contract B in the context of contract A.
The first contract is a simple wrapper or "proxy" which users interact with directly and is in charge of forwarding transactions to and from the second contract, which contains the logic. - OpenZepplin Docs
Instead of mapping every function one to one, the fallback function is leveraged.
That is, the logic contract controls the proxy’s state and the logic contract’s state is meaningless. Thus, the proxy doesn’t only forward transactions to and from the logic contract, but also represents the pair’s state. The state is in the proxy and the logic is in the particular implementation that the proxy points to.
Solidity uses slots to store data.
Using this bug, the attacker was able to call the initializer method of deployed Audius contracts that implement Initializable and change storage state that is intended to be set only once in initialization.
In other words:
the attacker was able to reinitialise governance contracts, delegating a large number of governance tokens to themself and bypassing safeguards meant to limit malicious proposals.
So, storage collision leads to deployment of malicious governance contract, and massive fraudulent token delegation which was used to pass a malcious governance proposal to send AUDIO tokens from the Audius community pool to the attacker.
Quick massive slippage sale of 6.1MM worth of AUDIO on Uniswap for ~1MM USD/704 ETH, ETH into TornadoCash.
Take aways:
-
super fast response, vuln mitigated within a few hours of discovery.
-
These contracts were deployed in October 2020 and this vulnerability has been live in the wild since that time. - audius-governance-takeover-post-mortem
- Human angle - why swap 6MM for 1MM? In a hurry?
Weekly Freestyle
Password Manager Nightmare
Who tried to own you this week?
Evolving SMS scams, likely from Ledger breach
References
OpenZepplin Audius Contracts Audit
https://kubertu.com/blog/solidity-storage-in-depth/