# Superfluid Yield Backends audit Sherlock · Money streaming · 13th January 2026 A private security review of Superfluid (money streaming), conducted with Sherlock and completed on 13th January 2026 over 3 days. 0xSimao disclosed 7 findings: 2 medium and 5 low. ## What Superfluid is Superfluid streams tokens continuously rather than in discrete transfers: Super Tokens extend ERC-20 with real-time balance flows, and agreements like constant flow and distribution pools move value every second inside the protocol-monorepo framework. ## Scope This January 2026 review covered the SuperToken yield backend support, an incremental update letting Super Tokens put idle underlying to work: an Aave backend and an ERC-4626 backend that deposit reserves into external yield sources while streaming continues against them. ## Medium severity findings - [AaveETHYieldBackend uses wrong WETH address for Polygon (returns WETH instead of WPOL)](https://0xsimao.com/findings/superfluid-aave-eth-yield-weth) - [Aave rounding behavior allows malicious users to drain accumulated yield via small withdrawals](https://0xsimao.com/findings/superfluid-aave-rounding-drain-yield) ## Low severity findings - [AaveYieldBackend.deposit() DoS when Aave pool is paused, frozen, or at supply cap](https://0xsimao.com/findings/superfluid-aave-yield-deposit-paused) - [ERC4626YieldBackend does not support vaults with deposit/withdrawal fees or slashing](https://0xsimao.com/findings/superfluid-erc4626-yield-withdrawal-slashing) - [ERC4626YieldBackend.withdrawMax() silently succeeds when vault is paused, leaving funds stuck](https://0xsimao.com/findings/superfluid-erc4626-yield-paused-stuck) - [ERC4626YieldBackend.withdrawSurplus() uses convertToAssets() which doesn't account for fees](https://0xsimao.com/findings/superfluid-erc4626-yield-withdraw-fees) - [SuperToken._skipSelfMint silently skips minting, breaking custom SuperToken implementations](https://0xsimao.com/findings/superfluid-super-mint-skips-implementations) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2026-01-13-superfluid.pdf)