# AaveETHYieldBackend uses wrong WETH address for Polygon (returns WETH instead of WPOL) Medium · Sherlock · Money streaming · 13th January, 2026 Finding M-1 of the Superfluid Yield Backends security review. - Protocol: https://superfluid.org/ - Report: /reports/superfluid - Codebase: https://github.com/0xsimao/protocol-monorepo/tree/d69e4b0394c38d2760b9b54f173a797b630c9ed1 - Source: https://github.com/superfluid-org/protocol-monorepo/blob/dev/packages/ethereum-contracts/audits/2026-01-27%20-%20Final%20-%20Superfluid%20Collaborative%20Audit%20Report%201769517931.pdf --- ## Summary `AaveETHYieldBackend` uses the wrong address for Polygon's native token wrapper - it returns WETH instead of WPOL (the native token wrapper for POL/MATIC). ## Vulnerability Detail In `getWETHAddress()`, for chain ID 137 (Polygon), the contract returns the WETH address (`0x7ceB23fD6bC0adD59E62ac25578270cFf1b9f619`) which is a bridged ETH token, instead of the native token wrapper WPOL at `0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270`. The contract is designed to wrap native ETH/tokens to their wrapped ERC20 equivalent and deposit them to Aave. On Polygon, native tokens (POL/MATIC) should be wrapped to WPOL, not WETH. WETH on Polygon is simply a bridged representation of Ethereum's ETH and is not the native token wrapper. ## Impact The `AaveETHYieldBackend` is unusable on Polygon. When users try to deposit native POL, the contract attempts to interact with the WETH contract which does not have a `deposit()` function that accepts native POL, causing all deposits to fail. ## Code Snippet https://github.com/sherlock-audit/2026-01-superfluid-update-jan-13th/blob/main/protocol-monorepo/packages/ethereum-contracts/contracts/superfluid/AaveETHYieldBackend.sol#L46-L48 ```solidity if (block.chainid == 137) { // Polygon return 0x7ceB23fD6bC0adD59E62ac25578270cFf1b9f619; //@audit ISSUE WETH not WPOL, WPOL is 0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270 } ``` ## Tool Used Manual Review ## Recommendation Return the correct WPOL address for Polygon: ```solidity if (block.chainid == 137) { // Polygon // Note this token has the symbol WPOL, wrapping the native token POL return 0x0d500B1d8E8eF31E21C99d1Db9A6444d3ADf1270; } ``` --- Related findings: - [Total `ETH`, `WETH` and `gameETH` are not tracked which will lead to insolvency](https://0xsimao.com/findings/codeup-eth-weth-tracked-insolvency): CODEUP - [Unrealized inflation calculation returns wrong value when balance reaches cap](https://0xsimao.com/findings/m-0-unrealized-inflation-returns-reaches): M^0 Minter Gateway - [Users cannot unstake from YiedlETHStakingEtherfi.sol, because YieldAccount.sol is incompatible with ether.fi's WithdrawRequestNFT.sol](https://0xsimao.com/findings/benddao-unstake-eth-staking-yield): BendDAO - [FairLauncher inherits BlastNoYieldAdapter but will hold ETH](https://0xsimao.com/findings/districtone-inherits-blast-yield-eth): DistrictOne