Spirit Protocol audit
A private security review of Spirit Protocol (AI revenue sharing), conducted solo and completed on 28th November 2025 over 3 days. 0xSimao disclosed 7 findings: 3 high severity, 1 medium, 1 low and 2 informational.
What Spirit Protocol is
Spirit Protocol routes the revenue of an AI business on-chain. The Spirit token is a Superfluid SuperToken, so income does not sit in a treasury waiting for claims: it streams, through Superfluid airstreams, to stakers and vesting recipients continuously.
Scope
The solo review covered the core contracts: the SpiritFactory minting the token and initialising its Uniswap market, the StakingPool with its RewardController distributing streamed income across staked balances, and the SpiritVestingFactory and SpiritVesting contracts streaming allocations to team and partners over time.
High severity findings
- SuperTokens are vulnerable to attacker frontrunning and minting free tokens
- Uniswap v4 pool initialization can be frontrunned, setting an arbitrary price, and stealing tokens
- Wrong rounding direction in StakingPool::unstake() can be abused
Medium severity findings
Low severity findings
Informational findings
- SpiritVestingFactory::createSpiritVestingContract overwrites the spiritVestings mapping for the same recipient
- SpiritVestingFactory::setTreasury() could be 2 factor, as well as the AccessControl OZ contract used in the codebase
The report