How a Storage Slot Collision Let an Attacker Seize Audius Governance

On Monday, July 25, 2022, Audius — a web3 music-streaming platform often compared to Spotify — suffered a governance exploit that saw roughly $6 million worth of its AUDIO token diverted from the protocol's treasury. AUDIO is used both to reward listeners and tip artists, as well as for voting on protocol governance.

The attacker pushed through a malicious governance proposal that moved funds directly out of the treasury, then sold the tokens on the open market, netting only around $1 million after heavy slippage.

News of the exploit first surfaced when a Twitter user flagged unusual activity; Audius quickly confirmed an "unauthorized transfer" had occurred and issued a public call for help investigating it.

Root cause: a storage collision in the upgrade proxy

Per Audius's own post-mortem, the attack hinged on how the protocol manages contract upgrades. Audius relies on an AudiusAdminUpgradeabilityProxy contract to upgrade its governance logic, with the proxyAdmin address stored in storage slot 0 — the same slot occupied by the address of the main governance contract.

That overlapped with a slot used by OpenZeppelin's Initializable contract, a documented weakness in unstructured storage proxies. Exploiting the collision allowed the attacker to re-initialize and take control of the governance contract, along with the ability to change parameters across Audius's Governance, Staking, and DelegateManagerV2 contracts.

Reconstructing the attack

The post-mortem describes the attacker's actions as follows:

1. Redefined voting on the protocol and modified the governance contract's guardian address.
2. Pointed the governance address of both the Staking and DelegateManagerV2 contracts to a custom governance contract deployment at 0xbdbb5945f252bc3466a319cdcc3ee8056bf2e569.
3. Recorded a fabricated delegation of 10,000,000,000,000 AUDIO to their own address in an attempt to pass a governance vote — an action confined to the internal storage of the Staking and Delegation contracts, with no impact on circulating supply.
4. Recorded a second fabricated delegation of 10,000,000,000,000 AUDIO for a second vote attempt — this one succeeded and triggered a real transfer of funds, again without directly affecting circulating supply.
5. Transferred 18,564,497 AUDIO tokens out of the community treasury via this transaction, routed to the attacker's address, 0xa0c7BD318D69424603CBf91e9969870F21B8ab4c.

The attacker then liquidated the entire haul in a single Uniswap v2 transaction, suffering heavy slippage that limited their take to roughly 704 ETH — about $1 million at the time. Those funds were moved into Tornado Cash approximately ten hours after the sale.

Limited fallout

Despite the sharp price swing triggered by the dump, AUDIO's price has remained relatively stable since the incident. A fast response from the Audius team, aided by outside assistance, combined with the fact that the loss came from the treasury rather than individual user balances, appears to have limited the damage.

Notably, the affected contracts had already been audited twice — once by Kudelski and once by OpenZeppelin — and the storage-collision issue exploited here was already documented as a known proxy pitfall. Even so, the incident does not appear to have done lasting damage to Audius's standing in the space.