Callisto Network

<h2 id="header-0">AUDIUS exploit</h2><p>On July 23, 2022, the AUDIUS governance, staking, and delegation contracts on Ethereum mainnet were compromised due to a bug in the contract initialization code that allowed repeated invocations of the initialize functions. The bug allowed an attacker to maliciously transfer 18MM <em>$AUDIO</em> tokens held by the AUDIUS governance contract.</p><p>You can find the <a href="https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22" rel="noopener noreferrer nofollow">detailed post-mortem report here</a> at AUDIUS blog.</p><h2 id="header-1">What happened?</h2><p>Ethereum smart-contracts are not upgradeable by default. In order to overcome this limitation developers often use “Proxy contracts”.</p><p>Proxy contracts are appointed to the “logic contract” and execute transactions by pulling the code from “logic contracts”. However Proxy contracts need to operate with their internal variables and store contract-related data which is persistent. The way data is stored in Ethereum leads to the problem known as <a href="https://docs.openzeppelin.com/upgrades-plugins/1.x/proxies#unstructured-storage-proxies" rel="noopener noreferrer nofollow">proxy storage collisions</a>.</p><p>Proxy contracts pull code from “logical” contracts and perform actions as if the storage structure of the proxy was identical to that of the “logic” contract, and if it does not match — mess occurs.</p><h2 id="header-2">The root of the problem</h2><p>Most of the problems happen where developers try to get around platform limitations and use methods that are ill-suited for this. Unfortunately this is the case with Ethereum and AUDIUS. The lack of built-in contract upgradeability is a security flaw of Ethereum.</p><p><strong>No program can be written without errors on the first try! </strong>Applying fixes and updating the code is an inevitable part of the development process.</p><p>The lack of this essential feature leads to the clunky attempts to circumvent it which leads to <a href="https://docs.openzeppelin.com/upgrades-plugins/1.x/proxies#storage-collisions-between-implementation-versions" rel="noopener noreferrer nofollow">a number of problems associated with proxy contracts</a>.</p><h2 id="header-3">Security measures</h2><ul><li>​<a href="https://decrypt.co/105913/how-audius-was-hacked-6m-ethereum-tokens" rel="noopener noreferrer nofollow">According to decrypt.co</a> AUDIUS contracts were audited twice (by OpenZeppelin in 2020 and Kudelski in 2021). The exploited issue was in the code for 2 years.</li><li><strong>There was no open bug bounty or exploit reporting program in place. </strong>It was possible to create a bounty program, then the hacker could report a bug rather than exploit it.</li><li><strong>It would be possible to insure a smart-contract</strong> that operates with huge quantities of funds in order to get a compensation in case of a hack. See <a href="https://dexaran820.medium.com/the-new-word-in-security-of-smart-contracts-auditable-insurance-6ddc6a5b17e0" rel="noopener noreferrer nofollow">Callisto Insurance program</a>​</li></ul><h2 id="header-4">Conclusions</h2><ul><li>Unfortunately the most common practice of re-inventing upgradeability in Ethereum is the use of Proxy-contracts. We strongly encourage DAPP developers to pay attention to the caveats related to Proxy-contracts.</li><li>Always have a bug bounty for your contracts. The more funds a contract is supposed to hold — the more important it is to adhere to the best-known security practices.</li><li>There is no single method to ensure that a program is completely secure. Always use <a href="https://www.ibm.com/docs/en/i/7.3?topic&#61;security-layered-defense-approach" rel="noopener noreferrer nofollow">multiple methods that complement each other</a>.</li><li>Smart-contracts are better suitable for solving the issue of trust rather than the issue of security. Use tools as they are the best fit.</li></ul>

AUDIUS Governance Exploit - A Comprehensive Overview

Table of Contents

Callisto Network

Other articles published on Jul 27, 2022

Token Tegro TGR on The Open Network blockchain

[RECAP] AMA: Kommunitas x Sportzchain

Recession and the Crypto Market

🔥Listing Celebration: 1,000,000 #RACA Airdrop 🔥

Economic analysis of private DeFi: Dr. Anish Mohammed, Panther's Chief Scientist

SubQuery Expansion into Cosmos Continues via Fetch-ai Network

Join our free newsletter for daily crypto updates!