Many metaverses operate with web3 coin decentralized management. In most administrations, a vote is offered, and the result is usually weighted by those with the largest number of tokens. That is, offerings in crypto help communities make decisions based on consensus. However, malicious people use it. However, for the decentralized music platform Auduis, acceptance of a malicious management proposal resulted in $5.9 million worth of token transfers, with the hacker earning $1 million.
Attack on Metaverse coin project
On July 24, a malicious bid (Proposal 85) requesting the in-house AUDIO token transfer of 18 million Audius was approved by a community vote. First mentioned on Twitter by @spreekaway, the attacker created the malicious proposal that they could “call initise() and set itself as the sole guardian of the management contract.” Further investigation by Auduis confirmed the unauthorized transfer of AUDIO tokens from the corporate treasury. Following the announcement, Auduis proactively stopped all Audius smart contracts and AUDIO tokens on the Ethereum Blockchain.
Blockchain researcher Peckshield further explained the flaw in Audius’ storage layout inconsistencies. The hacker’s management proposal was soon trashed as it dumped 18 million tokens worth about $6 million from the treasury. Sold for $1.08 million. While the dump resulted in the maximum slippage, investors recommended immediate buybacks to prevent existing investors from dumping and further lowering the token’s floor price. One investor said, “They hacked the community fund, right? Isn’t the team fund separate?” used his statements.
The issue of @AudiusProject lies in inconsistent storage layout between its proxy and impl. In particular, the collision of Audius Community Treasury contract results in an equivalence of disabling the initializer modifier. The proxyAdmin addr (0x..abac) plays a role here. pic.twitter.com/x4CqRncahp
— PeckShield Inc. (@peckshield) July 24, 2022
Cryptocurrency attacks continue
Meanwhile, Yuga Labs, the creator of the Bored Ape Yacht Club (BAYC), issued its second warning about an expected “coordinated attack” on its social media accounts. In June, as we reported on Kriptokoin.com, the pseudonymous co-founder of Yuga Labs, Gordon Goner, posted the first warning of a possible attack on his Twitter social media accounts. Immediately after the warning, Twitter officials strengthened their current security by actively following the accounts.
Meanwhile, the value of Audius’ AUDIO token plunged sharply. The cryptocurrency, which has lost 10 percent of its value, is changing hands at $ 0.34 at the time of writing.
10347
