Around $1.1 million worth of Audius’s AUDIO tokens were stolen over the weekend using a sophisticated attack involving the project’s governance forums.
Audius, a tokenized music streaming project, relies on community voting and governance for making future decisions. However, on 23 July a malicious proposal saw attackers put up a fake post and manipulate token votes to steal funds.
The attackers initially floated “Proposal #84,” which delegated 10 trillion AUDIO internally to the staking contract (without no token supply change). This transaction failed because no votes were cast on the proposal.
Attackers then floated “Proposal #85,” which requested the transfer of 18 million AUDIO tokens in a governance vote. The attackers were then “able to call initialize() and set himself as the sole guardian” of that governance contract, Audius developers explained in a post-mortem report on Monday.
The initialize() function gives a program its initial datapoint in a smart contract. This allowed the attacker to control the governance proposal solely and transfer tokens as the proposal was passed.
After Proposal #85 was put up, a transaction was executed that delegated some 10 trillion AUDIO towards the votes, thus skewing the proposal in favor of the attacker. Circulating supply was unaffected, but the proposal passed as the erroneous votes were able to trick Audius’ smart contacts. This allowed the attackers to maliciously transfer 18 million AUDIO tokens held by the Audius governance contract, referred to as the “community treasury, to a wallet of their control.”
The stolen tokens were then exchanged for over 700 ether (ETH), worth around $1.08 million at the time of writing, on privacy swap service Tornado Cash, blockchain data of the attacker’s wallet – 0xa62c3ced6906b188a4d4a3c981b79f2aabf2107f – show.
Meanwhile, Audius developers said a bug allowed the attacker to pass the initialize() function. “The Audius governance, staking, and delegation contracts on Ethereum mainnet,” developers explained in the post-mortem.
“[These] were compromised due to a bug in the contract initialization code that allowed repeated invocations of the initialize functions,” they added.
The set of exploited contracts was previously audited by the OpenZeppelin team, but the vulnerability was not caught at the time, Audius developers said. All remaining funds are safe and fixes have been deployed as on Monday.
