Superfluid Yield Backends audit
A private security review of Superfluid (money streaming), conducted with Sherlock and completed on 13th January 2026 over 3 days. 0xSimao disclosed 7 findings: 2 medium and 5 low.
What Superfluid is
Superfluid streams tokens continuously rather than in discrete transfers: Super Tokens extend ERC-20 with real-time balance flows, and agreements like constant flow and distribution pools move value every second inside the protocol-monorepo framework.
Scope
This January 2026 review covered the SuperToken yield backend support, an incremental update letting Super Tokens put idle underlying to work: an Aave backend and an ERC-4626 backend that deposit reserves into external yield sources while streaming continues against them.
Medium severity findings
- AaveETHYieldBackend uses wrong WETH address for Polygon (returns WETH instead of WPOL)
- Aave rounding behavior allows malicious users to drain accumulated yield via small withdrawals
Low severity findings
- AaveYieldBackend.deposit() DoS when Aave pool is paused, frozen, or at supply cap
- ERC4626YieldBackend does not support vaults with deposit/withdrawal fees or slashing
- ERC4626YieldBackend.withdrawMax() silently succeeds when vault is paused, leaving funds stuck
- ERC4626YieldBackend.withdrawSurplus() uses convertToAssets() which doesn't account for fees
- SuperToken._skipSelfMint silently skips minting, breaking custom SuperToken implementations
The report