Audius hack — July 2022

On 23 July 2022 an attacker took control of the governance of Audius, a decentralised music streaming protocol, and emptied its community treasury on Ethereum.

The flaw was a storage-layout collision between the proxy and implementation contracts. As Fairyproof described it, two variables pointed to the same slot: calling initialize() set Initializable.initializing to false, but a later operation set proxyAdmin to a non-zero value, which wrote back into that same slot and left the contracts looking uninitialised. PeckShield described the same defect as a collision that resulted in 'an equivalence of disabling the initializer modifier'. That let the attacker re-call initialize() on the Governance, Staking and DelegateManagerV2 contracts and install their own contract as governance guardian. A public proof-of-concept published afterwards reproduces exactly that sequence. The attacker then credited themselves an implausible voting balance - Decrypt reported an attempt to delegate 10 trillion AUDIO - and pushed through a proposal that moved roughly 18.6 million AUDIO out of the community treasury.

The tokens were worth about $6.1 million at the pre-attack price, but selling them into Uniswap liquidity crashed the market: the attacker realised just over 704 wrapped ether, about $1.07 to $1.08 million, which was routed to Tornado Cash. Coverage split accordingly, with some outlets reporting a $6 million theft and others a $1.08 million one. Both describe the same event; the gap is the difference between the market value of the tokens taken and what the attacker could actually sell them for.

The bug had survived audits by OpenZeppelin in 2020 and Kudelski in 2021 and sat in production for close to two years; the team acknowledged that 'audits are not bulletproof'. Co-founder Roneil Rumburg said the event was an exploit rather than a legitimate proposal, and that the governance system was only the entry point. Nothing was recovered and no one has been identified.