Incident Overview
AzukiDAO, an Ethereum-based DAO project, was exploited in a replay attack resulting in a loss of 72,693 $USD.
AzukiDAO's governance token contract (Bean) was exploited due to a contract vulnerability that was not properly checking the signatureClaimed variable, leading to replay attacks. Two attackers exploited this vulnerability and made a combined profit of approximately 35 ETH. The exploit has been halted with the contract currently in a paused state.
The funds are currently remaining in the attacker's address as ETH.
Attacker Address:
https://etherscan.io/address/0x85d231c2…64c75e
Malicious Transaction Example:
https://etherscan.io/tx/0x4c50c1da…e84acc
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to AzukiDAO, these are the critical security checks that could have prevented this incident (June 2023).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next AzukiDAO
The AzukiDAO hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.