SuperRare Hack

Reported loss $730K
Ethereum
updateMerkleRoot Access Control Exploit

What happened

On July 28, 2025, an attacker drained about $730,000 in RARE from SuperRare's Ethereum staking contract. A broken authorization condition let any caller replace the Merkle root used for reward claims, after which the attacker claimed the contract's RARE balance.

How it happened

  1. The staking contract exposed updateMerkleRoot() with an authorization predicate that accepted any caller.
  2. The attacker set a root corresponding to a claim for its chosen account and amount.
  3. The attacker used claim() against that root to withdraw about 11.9 million RARE from the staking contract.

Protocol details

Classification Protocol Logic / NFT / Access Control
Protocol Type NFT Marketplace
Implementation language Solidity
Protocol links Website @SuperRare

Market Context at Time of Hack

Token Price at Hack $0.0605
Market Cap at Hack $49.5M
Reported loss / token market cap 1.47%
Token Categories
Marketplace Collectibles & NFTs DAO Ethereum Ecosystem Base Ecosystem Binance Ecosystem Binance Listing
Protocol Links
GitHub Discord Reddit Telegram

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes