Superfluid Locker Pumponomics audit contest
A public audit contest on Sherlock (streaming), completed on 4th June 2025. 0xSimao placed #1. 6 of his findings are published: 2 high severity and 4 medium.
What Superfluid Locker System is
Superfluid's locker system wraps the SUP token programme: a locker holds a user's SUP, stakes it, and connects it to distribution programmes, with a Fontaine contract streaming unlocks over time and an early-exit penalty (the tax) redistributed to stakers who stay.
Scope
The second competition covered the locker system after the pumponomics upgrade: ETH deposits into lockers now route a share into buying the protocol token (the buy pressure its economics rely on) before entering Uniswap positions, alongside withdrawal-flag and program-start changes.
High severity findings
- Staked tokens inside FluidLocker can be withdrawn without calling Unstake
- Pumponomics can be skipped when using FluidLocker::provideLiquidity
Medium severity findings
- Incorrect initial deposit calculation may cause cancelProgram to revert
- Fluid (SUP) can be withdrawn from the Locker while the unlock flag is false
- Program start failure due to incorrect buffer calculation
- Locker owners can leverage low liquidity pools to bypass the tax mechanism
The contest