# AaveYieldBackend.deposit() DoS when Aave pool is paused, frozen, or at supply cap Low/Info · Sherlock · Money streaming · 13th January, 2026 Finding L-1 of the Superfluid Yield Backends security review. - Protocol: https://superfluid.org/ - Report: /reports/superfluid - Codebase: https://github.com/0xsimao/protocol-monorepo/tree/d69e4b0394c38d2760b9b54f173a797b630c9ed1 - Source: https://github.com/superfluid-org/protocol-monorepo/blob/dev/packages/ethereum-contracts/audits/2026-01-27%20-%20Final%20-%20Superfluid%20Collaborative%20Audit%20Report%201769517931.pdf --- ## Summary `AaveYieldBackend.deposit()` reverts when the Aave pool is paused, frozen, or the supply cap is reached, causing a DoS for all SuperToken upgrade/mint operations. ## Vulnerability Detail The `deposit()` function calls `AAVE_POOL.supply()` directly without handling cases where Aave may reject the deposit. Aave pools can be paused, frozen, or have supply caps that prevent new deposits. When any of these conditions occur, all SuperToken operations that trigger deposits (such as `upgrade()`, `upgradeTo()`, and `selfMint()`) revert. The underlying assets could simply be kept in the SuperToken contract when Aave is unavailable, but currently there is no fallback mechanism. ## Impact Users are unable to mint or upgrade SuperTokens when the underlying Aave pool is paused, frozen, or at supply capacity. This DoSes the core functionality of the SuperToken for an indeterminate period of time until Aave governance re-enables the pool. ## Code Snippet https://github.com/sherlock-audit/2026-01-superfluid-update-jan-13th/blob/main/protocol-monorepo/packages/ethereum-contracts/contracts/superfluid/AaveYieldBackend.sol#L49-L54 ```solidity function deposit(uint256 amount) public virtual { // TODO: can this constraint break anything? require(amount > 0, "amount must be greater than 0"); // Deposit asset and get back aTokens AAVE_POOL.supply(address(ASSET_TOKEN), amount, address(this), 0); } ``` ## Tool Used Manual Review ## Recommendation Implement a try-catch mechanism to handle Aave deposit failures gracefully. When the deposit fails, keep the underlying assets in the SuperToken contract: ```solidity function deposit(uint256 amount) public virtual { require(amount > 0, "amount must be greater than 0"); try AAVE_POOL.supply(address(ASSET_TOKEN), amount, address(this), 0) { // Deposit succeeded } catch { // Aave deposit failed (paused, frozen, supply cap reached) // Keep the underlying assets in the contract } } ``` --- Related findings: - [Frozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yield](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-paused-harvested-deposits-yield): Exactly Protocol Update - Staking Contract - [In GReservePool, if a strategy is frozen reserve pool stops working](https://0xsimao.com/findings/glacier-reserve-frozen-stops-working): Glacier - [Strategy withdraw may fail if weights of strategies differ from the real values and might lead to frozen ReservePool](https://0xsimao.com/findings/glacier-withdraw-weights-differ-real): Glacier - [Funding cap in `IDOPoolAbstract::_basicParticipationCheck()` is imprecise and can lead to excessive tokens sold](https://0xsimao.com/findings/blast-ido-pools-participation-imprecise-excessive-sold): Blast IDO Pools