# SuperTokens are vulnerable to attacker frontrunning and minting free tokens Crit/High · 0xSimao · AI revenue sharing · 28th November 2025 Finding H-1 of the Spirit Protocol security review. - Report: /reports/spirit-protocol - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-11-28-spirit-protocol.pdf --- **Description:** [SpiritToken::initialize()](https://github.com/0xPilou/spirit-contracts/blob/main/src/token/SpiritToken.sol#L14) is vulnerable to an attacker frontrunning the initialization with a malicious implementation, minting tokens for themselves, and then setting the implementation to `address(0)` again. The inherited `UUPSProxy` allows this because it has no access control, and although it checks for `initialAddress != address(0)`, this check won't exist on the new attacker implementation, so they can just reset it to 0 after minting free tokens. ```solidity function initializeProxy(address initialAddress) external { require(initialAddress != address(0), "UUPSProxy: zero address"); require(UUPSUtils.implementation() == address(0), "UUPSProxy: already initialized"); UUPSUtils.setImplementation(initialAddress); } ``` **Impact:** Spirit and Child tokens can be stolen. **Recommended Mitigation:** Add a deployer contract or make it access controlled by a trusted address in the constructor. **0xSimao:** Fixed in PR [#6](https://github.com/0xPilou/spirit-contracts/pull/6). --- Related findings: - [SuperToken._skipSelfMint silently skips minting, breaking custom SuperToken implementations](https://0xsimao.com/findings/superfluid-super-mint-skips-implementations): Superfluid Yield Backends - [An attacker may DoS user Fluid balance increases by frontrunning `FluidLocker::claim()` calls and calling `EP_PROGRAM_MANAGER::batchUpdateUserUnits()` directly](https://0xsimao.com/findings/superfluid-locker-system-increases-frontrunning-program-directly): Superfluid Locker System - [D1MemeTokens will be stuck whenever the merkle roots or the free claims are not fully claimed](https://0xsimao.com/findings/districtone-stuck-merkle-roots-claimed): DistrictOne - [Users can exploit the batch minting feature to avoid paying minting fees for tokens](https://0xsimao.com/findings/titles-publishing-protocol-exploit-feature-avoid-fees): TITLES Publishing Protocol