<!-- canonical: https://0xsimao.com/findings/superfluid-locker-system-ii-initial-deposit-program-revert -->

# Incorrect initial deposit calculation may cause cancelProgram to revert

Medium · Sherlock · Streaming · 4th June 2025

Finding M-3 of the Superfluid Locker Pumponomics competition.

- Protocol: https://audits.sherlock.xyz/contests/968
- Report: /reports/superfluid-locker-system-ii
- Codebase: https://github.com/0xsimao/2025-06-superfluid-locker-system/tree/d8beaeed47f766659a1600a87372a7905109aa3c
- Source: https://github.com/sherlock-audit/2025-06-superfluid-locker-system-judging/issues/96

---

### Summary

The `FluidEPProgramManager.cancelProgram()` function incorrectly assumes that governance parameters (minimum deposit and liquidation period) remain constant throughout a program's lifecycle. When these parameters change after program creation, the calculated `initialDeposit` for treasury return will be incorrect, potentially causing transaction reverts or wrong accounting.

### Root Cause

The vulnerability lies in the [`cancelProgram()`](https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/fluid/packages/contracts/src/FluidEPProgramManager.sol#L264-L268) function, where it recalculates the initial deposit amount using current governance parameters instead of the original values from when the program was funded:

```solidity
uint256 buffer =
    program.token.getBufferAmountByFlowRate(programDetails.fundingFlowRate + programDetails.subsidyFlowRate);
uint256 initialDeposit =
    buffer + uint96(programDetails.fundingFlowRate + programDetails.subsidyFlowRate) * EARLY_PROGRAM_END;
```

The buffer calculation depends on two governance-controlled parameters that can be changed at any time:

1. Minimum Deposit: retrieved via [`SUPERTOKEN_MINIMUM_DEPOSIT_KEY`](https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/protocol-monorepo/packages/ethereum-contracts/contracts/agreements/ConstantFlowAgreementV1.sol#L179-L181)
2. Liquidation Period: retrieved via [`CFAV1_PPP_CONFIG_KEY`](https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/protocol-monorepo/packages/ethereum-contracts/contracts/agreements/ConstantFlowAgreementV1.sol#L182-L183) and [decoded](https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/protocol-monorepo/packages/ethereum-contracts/contracts/agreements/ConstantFlowAgreementV1.sol#L184)

The buffer amount flows through this call chain:

```text
cancelProgram()
├── program.token.getBufferAmountByFlowRate(totalFlowRate)
    ├── SuperTokenV1Library.getBufferAmountByFlowRate()
        ├── cfa.getDepositRequiredForFlowRate(token, flowRate)
            ├── gov.getConfigAsUint256(host, token, SUPERTOKEN_MINIMUM_DEPOSIT_KEY)
            ├── gov.getConfigAsUint256(host, token, CFAV1_PPP_CONFIG_KEY)
            ├── SuperfluidGovernanceConfigs.decodePPPConfig(pppConfig)
            └── _getDepositRequiredForFlowRatePure(minimumDeposit, liquidationPeriod, flowRate)
                └── max(minimumDeposit, _clipDepositNumberRoundingUp(flowRate * liquidationPeriod))
```

### Internal Pre-conditions

1. The program needs to be cancelled

### External Pre-conditions

1. Superfluid governance changes either the minimum deposit or liquidation period parameters after program funding via:
   - [`setSuperTokenMinimumDeposit()`](https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/protocol-monorepo/packages/ethereum-contracts/contracts/gov/SuperfluidGovernanceBase.sol#L395-L404) for minimum deposit changes
   - [`setPPPConfig()`](https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/protocol-monorepo/packages/ethereum-contracts/contracts/gov/SuperfluidGovernanceBase.sol#L342-L364) for liquidation period changes

### Attack Path

1. Program is created and funded with `initialDeposit` calculated using current governance parameters
2. Superfluid governance changes minimum deposit or liquidation period via:
   ```text
   npx truffle exec ops-scripts/gov-set-token-min-deposit.js : {TOKEN_ADDRESS} {MINIMUM_DEPOSIT}
   npx truffle exec ops-scripts/gov-set-3Ps-config.js : {TOKEN_ADDRESS} {LIQUIDATION_PERIOD} {PATRICIAN_PERIOD}
   ```
3. When `cancelProgram()` is called, it recalculates `initialDeposit` using new parameters
4. If parameters increased: transaction attempts to return more funds
5. If parameters decreased: excess funds remain in contract rather than sent back to treasury

### Impact

When governance parameters increase after program creation, `cancelProgram()` calculates higher buffer requirement than originally deposited, returning more funds to treasury than expected which may cause transaction revert due to insufficient fund balance. This cause inability to cancel the program.

When governance parameters decrease after program creation, `cancelProgram()` calculates lower buffer requirement than originally deposited, causing excess funds to remain in the contract while treasury receives less than the original deposit amount.

### PoC

No response

### Mitigation

Store the original `initialDeposit` amount in the program struct and use it during cancellation:

```solidity
struct EPProgram {
    // ... existing fields ...
    uint256 initialDeposit;
}

// In fundProgram():
programs[programId].initialDeposit = initialDeposit;

// In cancelProgram():
token.transfer(TREASURY, programs[programId].initialDeposit);
```

This ensures the exact deposited amount is returned regardless of governance parameter changes.

---

Related findings:

- [Donation attack possible, although unlikely, could make an initial deposit](https://0xsimao.com/findings/aegis-donation-although-unlikely-deposit): Aegis Staked YUSD
- [Withdrawing after a slash event before the vault has ended will decrease `fixedSidestETHOnStartCapacity` by less than it should, so following users will withdraw more their initial deposit](https://0xsimao.com/findings/saffron-lido-vaults-slash-eth-withdraw-deposit): Saffron Lido Vaults
- [Incorrect `ERC4626ExceededMaxRedeem` event on `ManagedLeveragedVault.sol:: cancelWithdrawalIntent()`](https://0xsimao.com/findings/beraborrow-i-erc4626-exceeded-redeem-withdrawal): Beraborrow Managed Dens
- [Taker fee is underestimated due to incorrect fee calculation](https://0xsimao.com/findings/1inch-taker-fee-underestimated-calculation): 1inch Fee Extension