WEB3-PROXY-COLLISION-2022
Web3 · Ethereum · Upgradeable delegatecall proxy (Audius)
Résumé
On July 23, 2022 the Audius governance, staking, and delegation contracts on Ethereum mainnet were drained of 18,564,497 AUDIO (~$6.1M) because their upgradeable delegatecall proxy had a storage-layout collision with a re-callable initializer. A delegatecall proxy runs the logic contract's bytecode against the proxy's own storage, so the two contracts must agree on every slot index; Audius added a variable to the proxy that occupied the same low slot the implementation used for the OpenZeppelin Initializable initialized flag. Writing the proxy-side value reset the implementation's initialized boolean to a non-true state, removing the one-time guard, so the attacker re-invoked initialize() against an already-deployed contract. Re-initialization let the attacker register themselves as governance guardian and submit a malicious proposal that delegated enormous voting weight and executed an immediate treasury transfer. The contracts had been audited by OpenZeppelin and Kudelski but the collision was introduced later and missed.
Comment l’éviter dans votre code
- Use OpenZeppelin's initializer modifier plus _disableInitializers() in the implementation constructor.
- Define proxy admin/impl in EIP-1967 namespaced slots, never low slots that collide with logic variables.
- Run automated storage-layout diff (openzeppelin-upgrades) on every upgrade before deploy.
- Append new state variables only at the end of the layout; never insert or reorder existing slots.
- Verify on-chain that initialize() reverts post-deployment and that the initialized flag is set.
Références
Vulnérabilités liées
Tout Web3 →- CRITICALWEB3-NOMAD-2022
On August 1, 2022, the Nomad token bridge was drained of roughly $190 million in a few chaotic hours, and it became the first large crypto theft to turn into an open, crowdsourced free for all. Nomad processed cross chain messages in two steps: prove (record a message under a confirmed Merkle root) then process (execute it). A contract upgrade initialized the Replica contract with a committed root of bytes32(0), the empty tree root, and the initializer wrote confirmAt[bytes32(0)] = 1, permanently marking the zero root as trusted. Because any unproven message hash reads back the Solidity default of bytes32(0), the validity check acceptableRoot(0x00) returned true for every message that was never proven. Attackers skipped prove() entirely and called process() with crafted calldata, releasing funds with no Merkle proof at all. After the first transaction, anyone could copy it, swap in their own address and rebroadcast, so hundreds of opportunists piled in. Bridge TVL fell from about $190.7 million to under $2,000, and only roughly $36 to $39 million (about a fifth) was ever returned.
- CRITICALWEB3-PARITY-2017
The Parity multisig wallet, a popular way to hold Ethereum securely with multiple signers, suffered two disasters from the same design flaw in 2017. In July, an attacker exploited it to steal about $30 million. Then in November, a curious user poking at the code accidentally triggered the flaw in reverse and permanently froze about $150 million belonging to hundreds of wallets, locking it away forever with no way to recover it. Together they are the textbook lesson in smart-contract initialization, the danger of shared library code, and why an irreversible system can punish a single missing access check twice over.
- CRITICALWEB3-KELPDAO-LAYERZERO-2026
On April 18, 2026, North Korea's Lazarus Group drained about 116,500 rsETH (roughly $292 million) from KelpDAO's LayerZero-based bridge, the largest DeFi exploit of the year. No smart contract was broken; the contracts did exactly what they were written to do. The attack was against the bridge's off-chain verification. rsETH's LayerZero channel was configured to trust a single verifier (a 1-of-1 DVN), so the attackers compromised LayerZero's internal RPC nodes, knocked out the honest external node with a denial-of-service flood, and forced that single verifier to attest to a cross-chain message that never really happened. The Ethereum side then released unbacked rsETH from escrow, leaving wrapped rsETH stranded across more than twenty chains and triggering a bank-run across DeFi.
- HIGHWEB3-FRONTEND-DNS-HIJACK-2022
A frontend hijack leaves the on-chain contracts untouched but replaces the Web2 surface serving the dApp UI with a wallet-drainer clone, so no Solidity audit can catch it. The recurring pattern: attackers take over the domain registrar or DNS provider account (or a CDN/tag-manager account), repoint the domain to a cloned site, and prompt visitors to sign malicious token approvals, EIP-2612 permit signatures, or transfers. Curve Finance was hit twice: on August 9-10, 2022 its curve.fi domain was DNS-hijacked via a compromised nameserver and drained ~$570K in USDC/DAI; and again around May 12, 2025 at the registrar level, after which Curve permanently migrated to curve.finance and announced an ENS move (Convex Finance and Resupply, which depend on Curve's data feeds, suffered dependency-driven outages but were not themselves compromised). In July 2024 a mass wave hit DeFi domains registered through Squarespace, whose forced migration off Google Domains stripped 2FA: Compound's frontend redirected to an Inferno Drainer clone and 100+ protocols were exposed (Celer blocked its takeover via domain monitoring). Ambient Finance's domain was hijacked through stolen registrar credentials on October 17, 2024. Most recently, on April 14, 2026 attackers used forged identity documents to social-engineer the registrar into handing over DNS control of CoW Swap's swap.cow.fi and cow.fi domains, redirecting users to a pixel-perfect drainer clone for about 90 minutes; over $1M was taken in roughly three hours, including 219 ETH (~$750K) from a single wallet, while CoW's contracts, backend APIs, and solver network were untouched. The same bucket includes CDN-account injections (KyberSwap's September 2022 Cloudflare/Google Tag Manager compromise, ~$265K) and BGP route hijacks that swap signed bundles for drainer code.
- CRITICALWEB3-DRIFT-2026
On 1 April 2026, attackers drained about $285 million from Drift, the largest perpetual-futures exchange on Solana, in roughly twelve minutes, more than half of everything the protocol held. There was no smart-contract bug. The contracts worked exactly as written. The attackers, later tied to North Korea's Lazarus operations, spent months socially engineering the people with privileged access, then abused a Solana feature called durable nonces to get the protocol's multisig signers to approve, in advance and without realising it, the transactions that handed over control. Once they had admin rights they whitelisted a worthless token as collateral, deposited a pile of it, and borrowed out the real money. It is the case that proves the modern crypto heist is an operations and social-engineering problem, not a Solidity one.
- CRITICALWEB3-BUNNI-2025
On September 2, 2025 Bunni, a liquidity manager built on Uniswap v4, was drained of roughly $8.4 million across Ethereum and Unichain (USDC, USDT, and weETH/ETH) through a rounding error in its withdrawal accounting amplified by flash loans. Bunni's Liquidity Distribution Function (LDF) tracks an 'idle balance' that is rebalanced on every swap, and the withdraw path rounded that balance in the wrong direction under specific conditions. The attacker flash-borrowed millions in USDT and executed a precisely sized sequence of swaps that pushed the pool's spot price back and forth across tick boundaries, triggering the faulty rounding repeatedly; each cycle let them withdraw more tokens than they burned in liquidity (in the USDC/USDT pool the idle balance fell 85.7% while liquidity fell only 84.4%, and that gap was the leak). The bug was application-specific accounting math, not an oracle or price-feed flaw. Unable to fund a secure relaunch, the Bunni team announced on October 23, 2025 that it was permanently shutting down, leaving withdrawals open and relicensing v2 from BUSL to MIT.