Worked example · 2024-03

Curio DAO governance attack — Ethereum + multi-chain — 2024-03-23

Loss: approximately $16M nominal (CGT-token mint flooding pre-DEX-liquidity); realised economic loss ~$1M after operator emergency-pause and CGT downstream-liquidity-bound containment.
OAK Techniques observed: OAK-T9.003 (Governance Attack — voting-power-via-storage-collision subclass) + OAK-T9.002 (flash-loan precondition; loaned voting-power tokens to reach quorum) + OAK-T9.004 (Access-Control Misconfiguration in the upstream MakerDAO-fork governance proxy) + OAK-T16.001 (Vote Takeover via Flash-Loan — operational sub-pattern: flash-loaned voting-power tokens to reach quorum) + OAK-T16.005 (Malicious Proposal Snowballing — canonical MakerDAO-fork-substrate sub-shape of the storage-collision class, paired with Audius 2022 and Tornado Cash 2023).
Attribution: pseudonymous; partial recovery via negotiated 10% bug-bounty (~$1M ETH returned to Curio multisig) per Curio's post-incident communication.
Key teaching point: MakerDAO-governance-proxy code is itself a fork-substrate attack surface. Curio's governance contract was a MakerDAO Maker-fork; the same upstream-vulnerability class that did not affect MakerDAO mainnet (because of MakerDAO-specific governance-token distribution and economic-thresholds-of-attack) became exploitable in the fork because the fork's governance-token economic threshold was substantially smaller. Pairs with the Compound-v2-fork empty-market rounding-error cohort (Hundred → Midas → Sonne → Onyx) and the Uniswap-V2-fork multiple-fork-rug cohort as a recurring "fork-substrate-vulnerability-not-mitigated-at-fork-time" framework-level pattern.

Summary

Curio DAO is an Ethereum-based platform tokenising real-world-asset (RWA) collateral and offering CGT-collateralised-stablecoin (cgUSD) issuance via a governance-controlled MakerDAO Maker-fork governance proxy contract. On March 23, 2024, an attacker used a flash loan to acquire approximately 1% of CGT voting-power, exploited a storage-layout collision between the MakerDAO-fork governance proxy and the CGT token contract to elevate that 1% voting-position to administrative privileges over the CGT contract, and then minted approximately 1 billion CGT tokens (a nominal-supply ~16x-of-pre-event-supply event).

The realised economic loss was substantially smaller than the $16M nominal because (a) the on-chain CGT-to-USD market liquidity was thin and the attacker could not extract the full nominal value before market price collapsed, (b) Curio's operator-side response paused the contract within approximately three hours of the mint event, and (c) the attacker eventually negotiated a 10% bug-bounty return (~$1M) of the partial-extracted-and-liquidated proceeds to the Curio multisig. Curio subsequently issued a new CGT-v2 token via airdrop to legitimate pre-incident holders.

For OAK's purposes the case is a clean T9.003 storage-collision-governance-attack worked example complementing the canonical Audius July 2022 (examples/2022-07-audius.md) storage-collision-governance case and the Beanstalk April 2022 (examples/2022-04-beanstalk.md) flash-loan-quorum-governance case. Curio is the first major MakerDAO-fork-governance-attack on the public record and the canonical reference for the MakerDAO-fork-substrate vulnerability class.

Timeline (UTC)

When	Event	OAK ref
2024-03-23 ~11:30 UTC	Attacker initiates flash loan on CGT-voting-power token; combines with the storage-collision exploit on the upstream MakerDAO-fork proxy	T9.002 + T9.003 + T9.004
2024-03-23 ~11:35 UTC	Attacker mints approximately 1 billion CGT (~16x pre-event supply)	T9.003 (extraction)
2024-03-23 ~11:45 UTC	Attacker swaps a small portion of minted CGT to liquid assets via thin DEX liquidity; market price collapses	T7 broadly (laundering / monetisation start)
2024-03-23 ~14:30 UTC	Curio team detects + emergency-pauses the affected contracts	M34 (operator response)
2024-03-25 to 2024-03-29	Operator + attacker on-chain message-channel negotiation; ~10% bounty agreed	M35 (whitehat-rescue-coordination subclass)
2024-04 onward	Curio issues CGT-v2 via snapshot-based airdrop to pre-event holders; operator-funded compensation for documented losses	(operator response)

What defenders observed

Pre-event (no monitor on storage-collision class). Curio's pre-deployment audit by an independent firm did not flag the storage-collision dimension; the case is in the pre-deployment-audit-incomplete mitigation-failure class for OAK-M16. The MakerDAO-fork upstream's storage-layout assumptions were retained verbatim in the fork without an explicit fork-time storage-layout audit pass.
At-event (rapid mint-event detection). Curio team detected the mint event via standard token-supply monitoring within ~3 hours; OAK-M39 cross-protocol watcher-network deployment with per-protocol-mint-cap invariants would have shortened the detection window further.
Post-event (recovery-via-negotiation). Curio's on-chain message-channel negotiation produced a 10% bounty + 90% retention by the attacker; the negotiation-channel pattern follows the Euler Finance March 2023 (examples/2023-03-euler-finance.md) template and is canonical for the OAK-M35 whitehat-rescue-coordination class.

What this example tells contributors writing future Technique pages

Fork-substrate vulnerability is a recurring meta-class. Curio is the Curio-fork-of-MakerDAO case; the Hundred-Midas-Sonne-Onyx cohort is the Compound-v2-fork case; multiple Uniswap-V2-fork rug-pulls are the Uniswap-V2-fork case. Future T9 contributions should treat fork-substrate-vulnerability-not-mitigated-at-fork-time as a recurring framework-level meta-class and explicitly enumerate per-fork-substrate as a calibration variable.
Storage-layout audit is a discrete pre-deployment check class. The Curio storage-collision was a class of bug not always caught by general-purpose pre-deployment audits; future T9.004 contributions should explicitly enumerate storage-layout audit as a discrete check class composing with OAK-M16 pre-deployment audit.
Realised-loss-vs-nominal-loss distinction is operationally important. The $16M nominal loss vs the ~$1M realised loss illustrates that downstream-liquidity-bounds and operator emergency-pause speed produce a substantial realised-vs-nominal gap. Future T9.003 / T9.004 contributions should distinguish between these two loss measures and treat them as separate calibration variables.

Public references

Curio Protocol incident statement and post-mortem (March 2024) — [curiopostmortem2024].
PeckShield on-chain trace and headline figures — [peckshieldcurio2024].
BlockSec forensic walkthrough — [blocksec_curio2024].
SlowMist incident analysis — [slowmistcurio2024].
Halborn technical post-mortem — [halborncurio2024].

Citations

[curiopostmortem2024] — Curio operator-side post-mortem; documents the storage-collision root cause and the CGT-v2 airdrop-and-compensation framework.
[peckshieldcurio2024] — PeckShield on-chain trace.
[blocksec_curio2024] — BlockSec function-level walkthrough of the storage-collision exploit.
[slowmistcurio2024] — SlowMist incident analysis.
[halborncurio2024] — Halborn defender-oriented post-mortem.
[zhou2023sok] — academic taxonomy classifying this as a governance / proxy-storage-layout attack.

Discussion

Curio is a useful framework-level reference for two distinct proposition classes. First, it confirms the fork-substrate-vulnerability meta-class observed across Compound-v2-fork (Hundred → Midas → Sonne → Onyx) and Uniswap-V2-fork (multiple rug-pull cases) cohorts; the Maker-fork case adds a third fork-substrate to the recurring meta-class observation. Second, it confirms the storage-collision-governance-attack subclass as distinct from flash-loan-quorum-governance (Beanstalk) within OAK-T9.003; the two subclasses pair with the Audius July 2022 case and the Compound DAO Proposal 289 attempted-but-failed July 2024 case (examples/2024-07-compound-vote-takeover.md) to give T9.003 an articulated subclass-set rather than a single-mechanism Technique surface.

The realised-vs-nominal-loss distinction (~$1M realised vs $16M nominal) is also pedagogically useful for OAK contributors writing about flash-loan-funded mint-flooding extraction events; the distinction generalises across cases where the attacker reaches the extraction step but is bound by downstream-liquidity at the monetisation step. Future Technique-page contributions should make the loss-measurement convention explicit per-incident.