# Fluid (SUP) can be withdrawn from the Locker while the unlock flag is false Medium · Sherlock · Streaming · 4th June 2025 Finding M-4 of the Superfluid Locker Pumponomics competition. - Protocol: https://audits.sherlock.xyz/contests/968 - Report: /reports/superfluid-locker-system-ii - Codebase: https://github.com/0xsimao/2025-06-superfluid-locker-system/tree/d8beaeed47f766659a1600a87372a7905109aa3c - Source: https://github.com/sherlock-audit/2025-06-superfluid-locker-system-judging/issues/207 --- ### Summary The unlock flag is meant to signal that users can unlock SUP from their Locker. However, `provideLiquidity()` and `withdrawLiquidity()` are missing this flag, so users can unlock the SUP even with the unlock flag set to false. ### Root Cause https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/fluid/packages/contracts/src/FluidLocker.sol#L420 https://github.com/sherlock-audit/2025-06-superfluid-locker-system/blob/main/fluid/packages/contracts/src/FluidLocker.sol#L447 Provide liquidity and withdraw liquidity are missing the unlockAvailable modifier. ### Internal Pre-conditions None ### External Pre-conditions None ### Attack Path 1. Locker has the unlock flag set to false. 2. User can provide liquidity, wait the tax free period and withdraw liquidity, while the unlock flag is still false. ### Impact Users break key functionality. ### PoC None ### Mitigation Add the unlockAvailable modifier to these functions. --- Related findings: - [StakingOperator does not set isUnlockWindowActive to true in the constructor if the flag passed is true](https://0xsimao.com/findings/singularity-staking-window-active-flag): Singularity - [A malicious user may unlock instantly all the funds from the `FluidLocker` when no one is staking in the Tax pool](https://0xsimao.com/findings/superfluid-locker-system-unlock-instantly-staking-tax): Superfluid Locker System - [`FluidLocker::_getUnlockingPercentage()` uses 540 instead of `540 days` leading to stuck funds as the unlocking percentage will be bigger than `100%` and underflow](https://0xsimao.com/findings/superfluid-locker-system-540-stuck-bigger-underflow): Superfluid Locker System - [An attacker may DoS user Fluid balance increases by frontrunning `FluidLocker::claim()` calls and calling `EP_PROGRAM_MANAGER::batchUpdateUserUnits()` directly](https://0xsimao.com/findings/superfluid-locker-system-increases-frontrunning-program-directly): Superfluid Locker System