Skip to content
Request an audit

‹ All findings

Locker owners can leverage low liquidity pools to bypass the tax mechanism

MediumSuperfluid Locker Pumponomics·Sherlock · Streaming · 4th June 2025CodebaseM-6

ReportSource

Summary

Locker owners can match their SUP tokens with ETH and deploy liquidity into uniswapv3 pools, after doing this for 6 months they will get their SUP without paying tax, otherwise this tax can get up to 80%. The problem is that FluidLocker.sol::withdrawLiquidity transfers ETH to locker owners without considering price manipulations, because of this a locker owner can manipulate a pool's price such that liquidity will mostly consist of ETH and withdraw their liquidity in ETH, without paying taxes.

Root Cause

In FluidLocker.sol::withdrawLiquidity there is no check against price manipulations https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/fluid/packages/contracts/src/FluidLocker.sol#L447-L485

Internal Pre-conditions

N/A

External Pre-conditions

  1. Pool's liquidity is "low"

Attack Path

Assuming 1 ETH = 2000 SUP, and the initial liquidity is spread across the whole range, since this would be more resistant to price manipulation:

  1. Pool's reserves consist of 25 ETH and 50_000 SUP
  2. Locker owner matches this with 25 ETH and 50_000 SUP
  3. Locker owner flashloans and swaps 1500 ETH for 96764 SUP, pool reserves are 1550 ETH - 3235 SUP
  4. Locker owner withdraws liquidity, getting 775 ETH paid to his address and 1617.5 SUP back in the locker
  5. Locker owner swaps 46764 SUP of the 96764 SUP he had in the first swap, getting 749 ETH back In the end locker owner walks away with 22.65 ETH after paying the flashloan back with 0.09% fees, and 50K SUP in his address and 1617 SUP locked.

Impact

Depending on the liquidity present in the pools, a locker owner can bypass the tax mechanism with miniscule amounts lost compared to the normal exits present in the protocol.

Mitigation

Either make sure there is enough liquidity in the pools or use TWAP oracle to see if the price has been pushed to extreme while withdrawing liquidity.