Superfluid Hack

Reported loss $20.0M
Polygon
Forged Superfluid ctx through malformed callAgreement calldata

What happened

On February 8, 2022, an attacker exploited Superfluid's Polygon host contract to impersonate Super Token holders and drain assets from their wallets. Crafted calldata let the attacker create distribution indexes on behalf of victim accounts, move the resulting assets through Polygon exchanges, and swap part of the proceeds into ETH. Superfluid temporarily disabled agreement calls, deployed a patched host and agreement implementation, and contacted affected teams.

Technical root cause

Agreement contracts authenticated the Host contract but did not validate the decoded ctx supplied through it. Duplicate ABI-encoded ctx values allowed a forged context, including a victim sender address, to be decoded before the legitimate stamped context.

How it happened

Superfluid's callAgreement passes a serialized ctx object between the host and agreement contracts. The attacker supplied call data containing a forged ctx in the agreement-specific payload. When the host replaced the placeholder ctx, the final byte string contained both the attacker-controlled ctx and the legitimate host-generated ctx.

ABI decoding used the injected first ctx and ignored the remaining legitimate context. Because the agreement trusted calls from the Host without validating that decoded ctx against the Host's stored hash, it accepted an arbitrary spoofed sender. The attacker used that identity to create Instant Distribution Agreement indexes and distribute victims' Super Tokens to controlled accounts.

Protocol details

Classification Protocol Logic / Authorization Bypass
Protocol Type Payments
Affected asset / contract SuperQI
Implementation language Solidity
Protocol links Website @Superfluid_HQ
Attacker Address 0x1574F7F4C9d3aCa2EbcE918e5d19d18aE853c090
Exploit Transaction 0x396b6ee91216cf6e7c…0471ab4d67

Security review history

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes