# Superfluid Locker System audit contest Sherlock · Streaming · 20th November 2024 · #1 A public audit contest on Sherlock (streaming), completed on 20th November 2024. 0xSimao placed #1. 6 of his findings are published: 3 high severity and 3 medium. ## What Superfluid Locker System is Superfluid's locker system wraps the SUP token programme: a locker holds a user's SUP, stakes it, and connects it to distribution programmes, with a Fontaine contract streaming unlocks over time and an early-exit penalty (the tax) redistributed to stakers who stay. ## Scope The first Sherlock competition covered the locker core: lock and unlock flows, the penalty formula on early exits, Fontaine streaming behaviour, and the staking tax redistribution. ## High severity findings - [`FluidLocker::_getUnlockingPercentage()` incorrectly divides one of the components of the formula by `S`, leading to always having `80%` penalty](https://0xsimao.com/findings/superfluid-locker-system-unlocking-components-formula-penalty) - [`FluidLocker::_getUnlockingPercentage()` uses 540 instead of `540 days` leading to stuck funds as the unlocking percentage will be bigger than `100%` and underflow](https://0xsimao.com/findings/superfluid-locker-system-540-stuck-bigger-underflow) - [`Fontaine` never stops the flows to the tax and recipient, so the buffer component of the flows will be lost](https://0xsimao.com/findings/superfluid-locker-system-fontaine-stops-flows-component) ## Medium severity findings - [An attacker may DoS user Fluid balance increases by frontrunning `FluidLocker::claim()` calls and calling `EP_PROGRAM_MANAGER::batchUpdateUserUnits()` directly](https://0xsimao.com/findings/superfluid-locker-system-increases-frontrunning-program-directly) - [`FluidLocker::_getUnlockingPercentage()` divides before multiplying, suffering a significant precision error](https://0xsimao.com/findings/superfluid-locker-system-unlocking-multiplying-suffering-precision) - [A malicious user may unlock instantly all the funds from the `FluidLocker` when no one is staking in the Tax pool](https://0xsimao.com/findings/superfluid-locker-system-unlock-instantly-staking-tax) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/648)