Skip to content
Request an audit

‹ All findings

Fluid (SUP) can be withdrawn from the Locker while the unlock flag is false

MediumSuperfluid Locker Pumponomics·Sherlock · Streaming · 4th June 2025CodebaseM-4

ReportSource

Summary

The unlock flag is meant to signal that users can unlock SUP from their Locker. However, provideLiquidity() and withdrawLiquidity() are missing this flag, so users can unlock the SUP even with the unlock flag set to false.

Root Cause

https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/fluid/packages/contracts/src/FluidLocker.sol#L420 https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/fluid/packages/contracts/src/FluidLocker.sol#L447 Provide liquidity and withdraw liquidity are missing the unlockAvailable modifier.

Internal Pre-conditions

None

External Pre-conditions

None

Attack Path

  1. Locker has the unlock flag set to false.
  2. User can provide liquidity, wait the tax free period and withdraw liquidity, while the unlock flag is still false.

Impact

Users break key functionality.

PoC

None

Mitigation

Add the unlockAvailable modifier to these functions.