'Audits Are Not Bulletproof': How Audius Was Hacked for $6M in Ethereum Tokens

Decentralized streaming music service Audius was hacked for more than $6 million worth of AUDIO tokens over the weekend, which the attacker stole from its governance smart contract. In a postmortem report released late Sunday, the service detailed the attack and response—and noted that an undiscovered bug was exploited despite past security audits.

According to the report, the hacker tapped a bug in the smart contract initialization code that let it manipulate the service’s Ethereum-based governance, staking, and delegation contracts. A smart contract is the code that powers decentralized applications (dapps) in Web3, enabling apps, games, and protocols to operate without centralized intermediaries.

Given that decentralized model, Audius uses Ethereum-based ERC-20 tokens (AUDIO) to enable community governance. However, this model was ultimately exploited on Saturday. Through the exploit, the attacker altered the Audius voting structure and twice attempted to delegate 10 trillion AUDIO tokens to their wallet to push through governance proposals.

These moves did not affect the supply of AUDIO tokens, only the platform’s own token staking system. However, it did allow the attacker to pass a governance proposal that sent the entirety of the community token pool—nearly 18.6 million AUDIO tokens—to an external Ethereum wallet. The tokens were collectively worth nearly $6.1 million at the time of the heist.

According to a timeline of events shared by Audius, the project team was alerted to the attack about 25 minutes following the token transfer. The team then quickly brought on pseudonymous white hat hacker samczsun of VC firm Paradigm—who has successfully helped thwart past smart contract exploit attempts—to assist in the response.

Upon realizing that the exploit was still active, the team developed fixes that tapped the same vulnerability to ultimately halt its use, and spent the next several hours deploying patches to halt any further attacks. The team is still developing longer-term fixes, with further updates promised this week.

In the postmortem report, the Audius team was frank about potential shortcomings or oversights that could have enabled the heist and/or slowed its response.

For example, the team hadn’t actively worked on its Solidity/Ethereum Virtual Machine (EVM) code in nearly two years. “It took folks time to get back up to speed on all things here,” the team wrote, noting that it would stay “more in-tune with the latest state of the art of dev/debugging tooling” going forward.

However, the Audius smart contracts had been audited by security groups—first by OpenZeppelin in August 2020, with further contract additions audited by Kudelski in October 2021. Even so, that vulnerability remained open in the public for nearly two years since the contracts were first deployed in October 2020.

“Audits are not bulletproof,” the team wrote, noting that a contract's time spent in the wild without issues “can help build confidence, but does not rule out opportunities for exploitation.”

While the tokens were collectively valued above $6 million, the attacker traded them for a much lower value of Ethereum, perhaps in the haste to launder the funds. The tokens were traded for just over 704 Wrapped Ethereum (WETH)—about $1.07 million worth—on Saturday night via Uniswap, the leading decentralized exchange.

Afterwards, the attacker sent nearly all of the ETH through Tornado Cash, a mixing service that combines coins from multiple transactions to make it more difficult to trace the path of crypto funds on a blockchain.