Superfluid Hack

TOTAL LOST $20.0M
High Access Control Attacks Polygon

What happened

On February 8, 2022, an attacker exploited Superfluid's Polygon host contract to impersonate Super Token holders and drain assets from their wallets. Crafted calldata let the attacker create distribution indexes on behalf of victim accounts, move the resulting assets through Polygon exchanges, and swap part of the proceeds into ETH. Superfluid temporarily disabled agreement calls, deployed a patched host and agreement implementation, and contacted affected teams.

Technical Root Cause

Agreement contracts authenticated the Host contract but did not validate the decoded ctx supplied through it. Duplicate ABI-encoded ctx values allowed a forged context, including a victim sender address, to be decoded before the legitimate stamped context.

Case & protocol details

Classification Protocol Logic / Authorization Bypass
Protocol Type Payments
Affected asset / contract SuperQI
Smart Contract Language Solidity
Official Website www.superfluid.finance/
Protocol Twitter/X @Superfluid_HQ
Attacker Address 0x1574F7F4C9d3aCa2EbcE918e5d19d18aE853c090
Exploit Transaction 0x396b6ee91216cf6e7c…0471ab4d67

Attack Timeline

Superfluid's callAgreement passes a serialized ctx object between the host and agreement contracts. The attacker supplied call data containing a forged ctx in the agreement-specific payload. When the host replaced the placeholder ctx, the final byte string contained both the attacker-controlled ctx and the legitimate host-generated ctx.

ABI decoding used the injected first ctx and ignored the remaining legitimate context. Because the agreement trusted calls from the Host without validating that decoded ctx against the Host's stored hash, it accepted an arbitrary spoofed sender. The attacker used that identity to create Instant Distribution Agreement indexes and distribute victims' Super Tokens to controlled accounts.

Security review history

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes