Incident Overview
Superfluid protocol was exploited which lead to a loss of project funds for roughly 20,000,000 $USD.
Superfluid is a streaming protocol for real-time crypto transfers. On February 8, 2022, an attacker exploited Superfluid’s host contract by passing in faulty calldata, which allowed them to create distribution indexes spoofing several different accounts that held Super-tokens. This vulnerability enabled the attacker to move funds from Superfluid user wallets to exchanges on Polygon and swap them to ETH. The funds currently sit in the attacker’s wallet.
In total, 11,008 MATIC, 1,507,931 MOCA, 28 ETH, 39,357 sdam3CRV, 19,387,874 QI, 44,581 SDT, 23,653 STACK, and 562,834 USDC were stolen by the attacker. At the time of writing, over 2,700 ETH is sitting in the attacker’s wallet, as well as 500,000 MOCA.
callAgreement() function was exploited by replacing the bytes memory callData parameter. This parameter contains ctx value which can be decoded to get such properties: timestamp, msgSender, agreementSelector, userData, appAllowanceGranted, appAllowanceWanted, appAllowanceUsed, appAddress, appAllowanceToken. Ctx was replaced with the fake one, so the attacker was able to drain all SuperToken contract funds.
Attacker address:
https://polygonscan.com/address/0x1574f7f4…53c090
Malicious transaction:
https://polygonscan.com/tx/0x396b6ee9…ab4d67
Malicious contract:
https://polygonscan.com/address/0x32d47ba0…8da6d4
Claim transaction:
https://polygonscan.com/tx/0xdee86cae…dd6af6
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Superfluid, these are the critical security checks that could have prevented this incident (February 2022).
- Verify all logic paths related to CTX Exploit / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Sources & References
Learn to Prevent the Next Superfluid
The Superfluid hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.