# Spirit Protocol audit 0xSimao · AI revenue sharing · 28th November 2025 A private security review of Spirit Protocol (AI revenue sharing), conducted solo and completed on 28th November 2025 over 3 days. 0xSimao disclosed 7 findings: 3 high severity, 1 medium, 1 low and 2 informational. ## What Spirit Protocol is Spirit Protocol routes the revenue of an AI business on-chain. The Spirit token is a Superfluid SuperToken, so income does not sit in a treasury waiting for claims: it streams, through Superfluid airstreams, to stakers and vesting recipients continuously. ## Scope The solo review covered the core contracts: the SpiritFactory minting the token and initialising its Uniswap market, the StakingPool with its RewardController distributing streamed income across staked balances, and the SpiritVestingFactory and SpiritVesting contracts streaming allocations to team and partners over time. ## High severity findings - [SuperTokens are vulnerable to attacker frontrunning and minting free tokens](https://0xsimao.com/findings/spirit-protocol-super-frontrunning-minting-free) - [Uniswap v4 pool initialization can be frontrunned, setting an arbitrary price, and stealing tokens](https://0xsimao.com/findings/spirit-protocol-uniswap-initialization-frontrunned-price) - [Wrong rounding direction in StakingPool::unstake() can be abused](https://0xsimao.com/findings/spirit-protocol-rounding-staking-unstake-abused) ## Medium severity findings - [SpiritFactory won't be able to stop the Airstream contract](https://0xsimao.com/findings/spirit-protocol-spirit-won-stop-airstream) ## Low severity findings - [StakingPool is missing rewards distribution end logic](https://0xsimao.com/findings/spirit-protocol-staking-rewards-distribution-end) ## Informational findings - [SpiritVestingFactory::createSpiritVestingContract overwrites the spiritVestings mapping for the same recipient](https://0xsimao.com/findings/spirit-protocol-vesting-overwrites-vestings-recipient) - [SpiritVestingFactory::setTreasury() could be 2 factor, as well as the AccessControl OZ contract used in the codebase](https://0xsimao.com/findings/spirit-protocol-vesting-well-access-control) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-11-28-spirit-protocol.pdf)