Superfluid Locker System audit contest

A public audit contest on Sherlock (streaming), completed on 20th November 2024. 0xSimao placed #1. 6 of his findings are published: 3 high severity and 3 medium.

What Superfluid Locker System is

Superfluid's locker system wraps the SUP token programme: a locker holds a user's SUP, stakes it, and connects it to distribution programmes, with a Fontaine contract streaming unlocks over time and an early-exit penalty (the tax) redistributed to stakers who stay.

Scope

The first Sherlock competition covered the locker core: lock and unlock flows, the penalty formula on early exits, Fontaine streaming behaviour, and the staking tax redistribution.

High severity findings

• FluidLocker::_getUnlockingPercentage() incorrectly divides one of the components of the formula by S, leading to always having 80% penalty
• FluidLocker::_getUnlockingPercentage() uses 540 instead of 540 days leading to stuck funds as the unlocking percentage will be bigger than 100% and underflow
• Fontaine never stops the flows to the tax and recipient, so the buffer component of the flows will be lost

Medium severity findings

• An attacker may DoS user Fluid balance increases by frontrunning FluidLocker::claim() calls and calling EP_PROGRAM_MANAGER::batchUpdateUserUnits() directly
• FluidLocker::_getUnlockingPercentage() divides before multiplying, suffering a significant precision error
• A malicious user may unlock instantly all the funds from the FluidLocker when no one is staking in the Tax pool

The contest

View the contest page