Access control: who is allowed to call this

Graduate · enrolled learners

This lesson opens with Audius governance takeover, July 2022.

What happened

Audius ran its governance on upgradeable contracts, and the code that was supposed to set up and lock down those contracts, the initialization, was flawed: the proxy kept its admin address in storage slot 0, the same slot OpenZeppelin's Initializable used for its own guard, so the guard could be passed and an attacker was able to re-run initialization on the governance contracts on July 23, 2022. With governance re-initialized under their settings and a self-delegation of 10 trillion AUDIO of voting power, they submitted and passed a malicious proposal that moved 18,564,497 AUDIO from the community treasury to their own address, then sold it in one Uniswap trade for about 704 ETH. The contracts were not broken cryptographically and no signing key was stolen; the access control, the code that decides who is allowed to perform privileged actions, was defeatable, so the answer to 'who may control governance' turned out to be 'whoever exploits the initializer,' rather than 'only the project.' The privileged doors existed as intended, but the lock on them could be picked from the code, and once through, the attacker could do everything the project itself could do.

The decision point

Access control is the code that answers the question 'who is allowed to call this,' and every function that can move funds, change parameters, mint, upgrade or govern needs an explicit and correct check, because a function without a working guard answers 'anyone.' Audius is the case: its privileged governance role was meant for the project, but a flaw in initialization let an attacker re-run setup and take over governance, and from there they passed a proposal that drained the treasury, because once the guard on 'who' failed, the attacker inherited every privilege the project had. The mental model from the prior lesson, that the machine executes the literal code, applies sharply here: a privileged function is protected only by the check actually written on it, so 'only the owner can call this' is true only if the code verifies the caller is the owner, and a check that can be bypassed, through a re-runnable initializer, an unset variable, a wrong comparison, is a check that is not there. So the discipline is to enumerate every privileged function in a contract and, for each, find the exact code that restricts who may call it, confirm that restriction cannot be re-run or bypassed, and treat any privileged function whose guard is missing, defeatable or merely intended as open to anyone, because access control is not a property a contract has by default; it is code that must be written, correct, and impossible to reset, and Audius is what a privileged door with a pickable lock hands to whoever tries the handle.

Recorded loss

$6,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.