SuperRare Hack
What happened
On July 28, 2025, SuperRare's RareStakingV1 contract was exploited for approximately $730,000 USD (~11.9M RARE tokens). The vulnerability stemmed from a broken access control check in the updateMerkleRoot() function that allowed any unauthorized user to submit malicious Merkle roots and fraudulently claim tokens from the staking reward pool.
The root cause was a critical logic flaw in the updateMerkleRoot() function's access control mechanism. The function was designed to restrict Merkle root updates to the contract owner or a specific authorized address, but contained a misconfigured require statement using inverted logic. The vulnerable code used require((msg.sender != owner() || msg.sender != address(0xc2F394a4…7c8ddc)), "Not authorized to update merkle root"); with != (not equal) operators and an || (OR) condition.
This logic incorrectly allowed any address to pass the check, since any address cannot simultaneously be both the owner and the authorized address, making the condition always evaluate to true. The attacker exploited this by calculating a malicious Merkle root (0x93f3c), submitting it via a frontrunner transaction, and then using the claim() function to withdraw the tokens. The stolen funds remain in the attacker's contract and have not been swapped, with the $RARE token itself unaffected by the exploit.
Case & protocol details
Evidence & learning
Attack pattern
Compare incidents →Proof of concept
1 availableSources and on-chain records
- report Report x.com
- analysis Twitter/X Alert x.com
- analysis Website reference phemex.com
- analysis Blog reference blog.solidityscan.com
- analysis Website reference x.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
