{"investigation":{"slug":"superfluid","entity_name":"Superfluid","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Superfluid is an asset streaming and programmable cash flow protocol founded in 2020, deployed across Ethereum, Polygon, and multiple other EVM chains. On February 8, 2022, an attacker exploited a context serialization vulnerability in the protocol's host contract, draining approximately $8.7 million in assets from multiple projects including QiDAO, Stake DAO, Stacker Ventures, and Museum of Crypto Art. The protocol patched the vulnerability within hours, partially compensated affected parties, and has continued operating with additional audits and a native SUP token launch in 2025.","sections":[{"content":"On February 8, 2022 at approximately 06:17 UTC, an attacker exploited a critical vulnerability in Superfluid's host contract by crafting malicious calldata that forged context (ctx) objects. The flaw involved improper validation during context serialization and deserialization: the attacker injected a fake ctx value containing two versions of context data — an attacker-controlled forged version and a legitimate one. When the agreement contract deserialized these values, it retained the first (forged) context while discarding the legitimate one, and critically the Host contract failed to validate the injected context against stored hash values. This allowed the attacker to impersonate other accounts, create distribution indexes, and drain Super Token balances from vesting contracts. The attacker's address is 0x1574f7f4c9d3aca2ebce918e5d19d18ae853c090. Total assets taken included approximately 19,387,874 QI tokens, 1,507,931 MOCA, 562,834 USDC, 44,581 SDT, 23,653 STACK, 28 ETH, 39,357 sdam3CRV, and 11,008 MATIC, valued in total at approximately $8.7 million at time of theft. The attacker's wallet address had been funded via Tornado Cash, complicating attribution efforts. The Superfluid team was notified at 6:48 AM UTC, issued a public disclosure at 8:35 AM UTC, executed an emergency upgrade blocking agreement invocations at 10:54 AM UTC, and deployed a patched contract at 12:23 PM UTC. A $1 million bounty for the return of stolen funds was offered and remains unclaimed. The attacker has not been identified.","heading":"February 2022 Exploit","sources":[{"url":"https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd","name":"medium.com","type":"other","credibility":3},{"url":"https://rekt.news/superfluid-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-superfluid-hack-february-2022","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=2022-02-08-2","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploit impacted multiple DeFi protocols that had granted Superfluid vesting contracts access to their treasuries. QiDAO (Mai Finance) suffered the most severe loss, with 19,387,874 QI tokens drained; the QI token price dropped approximately 80-87% in the immediate aftermath. Stake DAO (SDT), Stacker Ventures (STACK), and Museum of Crypto Art (MOCA) also suffered material losses. Initial community estimates placed total losses at $13 million or higher when accounting for token prices at the time, with the $8.7 million figure reflecting the conservative market value of assets taken. Within 18 hours of the attack, Superfluid recapitalized 80% of affected addresses through a direct USDC transfer. The remaining 20% — representing over 90% of the funds stolen by dollar value, primarily the QI and MOCA losses — was addressed through a longer-term compensation plan negotiated with the affected teams. Full restitution was not achieved through fund recovery; the attacker retained the stolen assets.","heading":"Affected Projects and Losses","sources":[{"url":"https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd","name":"medium.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/polygon-stablecoin-qidao-exploited-for-13m-on-superfluid-vested-contract","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://beincrypto.com/qidao-experiences-exploit-of-superfluid-smart-contract-code-20m-estimated-to-be-lost/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://rekt.news/superfluid-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the February 2022 exploit, Superfluid commissioned multiple third-party security audits. In June 2022, Halborn completed an audit of the core smart contracts and reported no new critical vulnerabilities, though it made general code quality recommendations. The yAcademy (now Electisec) also conducted a review of the Superfluid codebase over 14 days in June-July 2022, with over 40 man-hours of analysis from resident auditors and fellows. Superfluid also established a formal bug bounty program on Immunefi offering up to $200,000 in rewards for disclosed vulnerabilities. In June 2025, Sherlock conducted a competitive audit of Superfluid's new Locker System contracts (the SUP token staking and vesting infrastructure), uncovering several medium-severity issues: a tax mechanism bypass via low-liquidity pool manipulation, an immutable UNLOCK_AVAILABLE flag that could permanently lock user funds if incorrectly initialized, and a CREATE2 front-running vulnerability enabling denial-of-service for legitimate users. These findings were documented publicly via the Sherlock audit judging repository.","heading":"Post-Exploit Security Response","sources":[{"url":"https://medium.com/superfluid-blog/strengthening-superfluid-protocol-security-with-additional-third-party-audits-c17c2ca93e73","name":"medium.com","type":"other","credibility":3},{"url":"https://medium.com/superfluid-blog/results-from-halborn-smart-contracts-audit-5070a2945357","name":"medium.com","type":"other","credibility":3},{"url":"https://reports.electisec.tech/reports/06-2022-Superfluid","name":"reports.electisec.tech","type":"other","credibility":3},{"url":"https://immunefi.com/bug-bounty/superfluid/information/","name":"immunefi.com","type":"other","credibility":3},{"url":"https://github.com/sherlock-audit/2025-06-superfluid-locker-system","name":"github.com","type":"other","credibility":3},{"url":"https://audits.sherlock.xyz/contests/648","name":"audits.sherlock.xyz","type":"other","credibility":3}],"severity":"medium"},{"content":"Superfluid was founded in 2020 by Francesco Renzi (CEO), Miao (CTO), and Michele D'Aliessi (COO). The protocol introduces Super Tokens, an extension of the ERC-20 standard that enables real-time money streaming and programmable distributions. It is deployed on Ethereum Mainnet, Polygon, Gnosis Chain, Arbitrum, Optimism, Avalanche, BNB Smart Chain, CELO, and Base among other networks. In July 2021, Superfluid raised a $9 million seed round led by Multicoin Capital, with participation from Semantic Ventures, DeFiance Capital, Delphi Digital, DeFi Alliance, Divergence Ventures, and angels including Balaji Srinivasan, Ryan Selkis, and Stani Kulechov. In February 2024, the protocol raised an additional $5.1 million strategic round led by Fabric Ventures, bringing total disclosed funding to approximately $14.1 million.","heading":"Protocol Overview and Team","sources":[{"url":"https://www.theblock.co/post/111139/ethereum-money-streaming-protocol-superfluid-raises-9-million-seed","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/278615/ethereum-token-streaming-protocol-superfluid-strategic-funding","name":"theblock.co","type":"other","credibility":3},{"url":"https://superfluid.org/post/superfluid-secures-usd5-1m-to-boost-growth","name":"superfluid.org","type":"other","credibility":3},{"url":"https://www.cbinsights.com/company/superfluid-finance/people","name":"cbinsights.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In February 2025, Superfluid introduced its native governance token SUP, with a total supply of 1 billion tokens. Token allocation distributed 60% to the community, 35% to the DAO Treasury, 25% to the development team, and 15% to early investors, with team and investor tokens subject to a 3-year lockup stream with a 1-year cliff. A Token Generation Event (TGE) concluded in November 2025. The token listed on Binance Alpha in August 2025 but experienced a 25-30% price decline within 24 hours of listing, attributed to immediate selling from a 50 million token airdrop. Initial transferability was restricted; governance proposal SIP #7 outlined milestones for enabling full transferability. No regulatory actions or securities enforcement proceedings related to the SUP token have been publicly identified as of the time of this investigation.","heading":"SUP Token Launch (2025)","sources":[{"url":"https://superfluid.org/post/introducing-sup-the-superfluid-token","name":"superfluid.org","type":"other","credibility":3},{"url":"https://icodrops.com/superfluid/","name":"icodrops.com","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2168549","name":"chaincatcher.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020","event":"Superfluid protocol founded by Francesco Renzi, Miao, and Michele D'Aliessi","source":"","date_original":"2020-01-01"},{"date":"2021-07-13","event":"Superfluid raises $9 million seed round led by Multicoin Capital","source":""},{"date":"2022-02-08","event":"Attacker exploits context serialization vulnerability in Superfluid host contract, draining approximately $8.7 million from vesting contracts across QiDAO, Stake DAO, Stacker Ventures, and Museum of Crypto Art","source":""},{"date":"2022-02-08","event":"Emergency protocol upgrade deployed within ~4 hours of exploit; $1 million bounty offered to attacker for fund return","source":""},{"date":"2022-02-09","event":"Superfluid recapitalizes 80% of affected addresses with direct USDC transfer within 18 hours; longer-term compensation plan negotiated for remaining losses","source":""},{"date":"2022-06","event":"Halborn and yAcademy (Electisec) complete post-exploit security audits; no new critical vulnerabilities found","source":"","date_original":"2022-06-01"},{"date":"2024-02-22","event":"Superfluid raises $5.1 million strategic round led by Fabric Ventures","source":""},{"date":"2025-02-19","event":"Superfluid introduces SUP governance token with 1 billion total supply; 60% allocated to community","source":""},{"date":"2025-06-04","event":"Sherlock competitive audit of Superfluid Locker System identifies multiple medium-severity vulnerabilities in SUP staking and vesting contracts","source":""},{"date":"2025-08-05","event":"SUP token lists on Binance Alpha; price declines 25-30% within 24 hours on airdrop sell pressure","source":""},{"date":"2025-11-22","event":"Superfluid Token Generation Event (TGE) concludes","source":""}],"sources_used":[{"url":"https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://rekt.news/superfluid-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260415165912/https://rekt.news/superfluid-rekt","credibility":3,"archive_timestamp":"2026-04-15T16:59:12+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-superfluid-hack-february-2022","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260317031323/https://www.halborn.com/blog/post/explained-the-superfluid-hack-february-2022","credibility":3,"archive_timestamp":"2026-03-17T03:13:23+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=2022-02-08-2","name":"web3isgoinggreat.com","type":"other","archive_url":"https://web.archive.org/web/20260830094311/https://www.web3isgoinggreat.com/?id=2022-02-08-2","credibility":3,"archive_timestamp":"2026-08-30T09:43:11+00:00"},{"url":"https://cointelegraph.com/news/polygon-stablecoin-qidao-exploited-for-13m-on-superfluid-vested-contract","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260830083917/https://cointelegraph.com/news/polygon-stablecoin-qidao-exploited-for-13m-on-superfluid-vested-contract","credibility":3,"archive_timestamp":"2026-08-30T08:39:17+00:00"},{"url":"https://beincrypto.com/qidao-experiences-exploit-of-superfluid-smart-contract-code-20m-estimated-to-be-lost/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/superfluid-blog/strengthening-superfluid-protocol-security-with-additional-third-party-audits-c17c2ca93e73","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/superfluid-blog/results-from-halborn-smart-contracts-audit-5070a2945357","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://reports.electisec.tech/reports/06-2022-Superfluid","name":"reports.electisec.tech","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://immunefi.com/bug-bounty/superfluid/information/","name":"immunefi.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://github.com/sherlock-audit/2025-06-superfluid-locker-system","name":"github.com","type":"other","archive_url":"https://web.archive.org/web/20260829193220/https://github.com/sherlock-audit/2025-06-superfluid-locker-system","credibility":3,"archive_timestamp":"2026-08-29T19:32:20+00:00"},{"url":"https://audits.sherlock.xyz/contests/648","name":"audits.sherlock.xyz","type":"other","archive_url":"http://web.archive.org/web/20260412084455/https://audits.sherlock.xyz/contests/648","credibility":3,"archive_timestamp":"2026-04-12T08:44:55+00:00"},{"url":"https://www.theblock.co/post/111139/ethereum-money-streaming-protocol-superfluid-raises-9-million-seed","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/278615/ethereum-token-streaming-protocol-superfluid-strategic-funding","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://superfluid.org/post/superfluid-secures-usd5-1m-to-boost-growth","name":"superfluid.org","type":"other","archive_url":"http://web.archive.org/web/20260519121522/https://superfluid.org/post/superfluid-secures-usd5-1m-to-boost-growth","credibility":3,"archive_timestamp":"2026-05-19T12:15:22+00:00"},{"url":"https://www.cbinsights.com/company/superfluid-finance/people","name":"cbinsights.com","type":"other","archive_url":"https://web.archive.org/web/20260829200924/https://www.cbinsights.com/company/superfluid-finance/people","credibility":3,"archive_timestamp":"2026-08-29T20:09:24+00:00"},{"url":"https://superfluid.org/post/introducing-sup-the-superfluid-token","name":"superfluid.org","type":"other","archive_url":"http://web.archive.org/web/20260314015927/https://superfluid.org/post/introducing-sup-the-superfluid-token","credibility":3,"archive_timestamp":"2026-03-14T01:59:27+00:00"},{"url":"https://icodrops.com/superfluid/","name":"icodrops.com","type":"other","archive_url":"http://web.archive.org/web/20260608115529/https://icodrops.com/superfluid/","credibility":3,"archive_timestamp":"2026-06-08T11:55:29+00:00"},{"url":"https://www.chaincatcher.com/en/article/2168549","name":"chaincatcher.com","type":"other","archive_url":"https://web.archive.org/web/20260829201243/https://www.chaincatcher.com/en/article/2168549","credibility":3,"archive_timestamp":"2026-08-29T20:12:43+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:51.396339+00:00","updated_at":"2026-09-01T04:16:56.653999+00:00"}}