# Superfluid Locker Pumponomics audit contest Sherlock · Streaming · 4th June 2025 · #1 A public audit contest on Sherlock (streaming), completed on 4th June 2025. 0xSimao placed #1. 6 of his findings are published: 2 high severity and 4 medium. ## What Superfluid Locker System is Superfluid's locker system wraps the SUP token programme: a locker holds a user's SUP, stakes it, and connects it to distribution programmes, with a Fontaine contract streaming unlocks over time and an early-exit penalty (the tax) redistributed to stakers who stay. ## Scope The second competition covered the locker system after the pumponomics upgrade: ETH deposits into lockers now route a share into buying the protocol token (the buy pressure its economics rely on) before entering Uniswap positions, alongside withdrawal-flag and program-start changes. ## High severity findings - [Staked tokens inside FluidLocker can be withdrawn without calling Unstake](https://0xsimao.com/findings/superfluid-locker-system-ii-staked-inside-withdrawn-unstake) - [Pumponomics can be skipped when using FluidLocker::provideLiquidity](https://0xsimao.com/findings/superfluid-locker-system-ii-pumponomics-skipped-fluid-provide) ## Medium severity findings - [Incorrect initial deposit calculation may cause cancelProgram to revert](https://0xsimao.com/findings/superfluid-locker-system-ii-initial-deposit-program-revert) - [Fluid (SUP) can be withdrawn from the Locker while the unlock flag is false](https://0xsimao.com/findings/superfluid-locker-system-ii-sup-withdrawn-flag-false) - [Program start failure due to incorrect buffer calculation](https://0xsimao.com/findings/superfluid-locker-system-ii-program-start-failure-buffer) - [Locker owners can leverage low liquidity pools to bypass the tax mechanism](https://0xsimao.com/findings/superfluid-locker-system-ii-owners-low-bypass-mechanism) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/968)