{"investigation":{"slug":"superrare","entity_name":"SuperRare","trust_score":45,"severity_base":null,"score_modifier":-7,"confidence":0.78,"status":"published","content_type":"investigation","summary":"SuperRare is a curated Ethereum-based NFT art marketplace founded in 2018 by John Crain, Charles Crain, and Jonathan Perkins, operating as a high-end platform for 1-of-1 digital artworks with its own governance token RARE. On July 28, 2025, a critical access control vulnerability in the platform's RareStakingV1 staking contract was exploited, resulting in the theft of approximately 11.9 million RARE tokens worth roughly $731,000. SuperRare subsequently reimbursed the 61 affected wallets by August 5, 2025, and the RARE token recovered approximately 41% following the remediation announcement.","sections":[{"content":"SuperRare is a peer-to-peer NFT art marketplace built on Ethereum, specializing in single-edition (1-of-1) digital artworks tokenized as ERC-721 tokens. The platform was co-founded in 2018 by CEO John Crain, CTO Charles Crain, and Jonathan Perkins. The team began development in late 2017, initially bootstrapped without external investment before launching publicly. SuperRare has described its positioning as 'Instagram meets Christie's,' emphasizing strict artist curation as a differentiator from open-access NFT platforms. The platform charges a 15% primary sale fee to artists and a 3% buyer fee on purchases; secondary sales yield a 10% royalty to the original artist. In March 2021, SuperRare raised $9 million in a Series A round led by Velvet Sea Ventures and 1confirmation, with participation from Collaborative Fund, Samsung Next, BlockTower Capital, Ashton Kutcher, Mark Cuban, Chamath Palihapitiya, and Marc Benioff. The platform transitioned toward decentralization in August 2021 with the introduction of the RARE governance token and the SuperRare DAO, which oversees platform parameters, allocates community treasury funds, and controls curatorial policies. Total historical trading volume on the platform has been estimated at approximately $210 million.","heading":"Platform Overview and Background","sources":[{"url":"https://news.artnet.com/market/superrare-founders-2086177","name":"news.artnet.com","type":"other","credibility":3},{"url":"https://www.gemini.com/cryptopedia/superrare-nft-marketplace-superrare-crypto-art-market","name":"gemini.com","type":"other","credibility":3},{"url":"https://www.samsungnext.com/blog/why-we-invested-in-superrare-a-digital-art-marketplace","name":"samsungnext.com","type":"other","credibility":3},{"url":"https://medium.com/superrare/announcing-the-rare-curation-token-and-the-superrare-network-390ff60b50a","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 28, 2025, SuperRare's RareStakingV1 staking contract (deployed at 0xfFB512B9176D527C5D32189c3e310Ed4aB2Bb9eC on Ethereum) was exploited through a critical broken access control vulnerability. The flaw resided in the contract's updateMerkleRoot() function, which contained inverted permission logic: the require statement used NOT-EQUAL operators combined with OR logic — specifically 'require((msg.sender != owner() || msg.sender != address(0xc2F394a45e994bc81EfF678bDE9172e10f7c8ddc)))' — which paradoxically allowed any caller to pass the check since no address can simultaneously equal both the owner and the authorized address. This effectively removed all access restrictions from the function. The attacker (address: 0x5B9B4B4DaFbCfCEEa7aFbA56958fcBB37d82D4a2) exploited this flaw in three steps: computing a malicious Merkle root, submitting it through the unprotected function, and using the fraudulent root to claim approximately 11,907,874 RARE tokens. The exploit transaction hash was 0xd813751bfb98a51912b8394b5856ae4515be6a9c6e5583e06b41d9255ba6e3c1. A notable complication arose when a frontrunner observed the attacker's pending transaction in the mempool and submitted a competing transaction with higher gas fees one block after the original attacker's contract deployment, ultimately claiming the stolen tokens first. The attacker's wallet had been funded via Tornado Cash approximately 186 days before the exploit, indicating premeditated planning and deliberate obfuscation of the funding source. The RARE token price dropped approximately 12% immediately following public disclosure of the exploit. On-chain data confirmed the stolen tokens remained in the attacker's address without being swapped or laundered in the period immediately following the incident. SuperRare clarified that the exploit was isolated to one staking vault and that NFTs on the platform, as well as the main trading and auction infrastructure, were unaffected. The vulnerability is classified under OWASP SC01:2025 Access Control Vulnerabilities.","heading":"July 2025 Smart Contract Exploit ($731K)","sources":[{"url":"https://blog.solidityscan.com/superrare-hack-analysis-488d544d89e0/","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/superrare-nft-exploited-rare-tokens/","name":"cryptopolitan.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/superrare-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.resonance.security/blog-posts/superrare-gets-rekt-how-a-730k-staking-exploit-became-the-nft-worlds-latest-wake-up-call","name":"resonance.security","type":"other","credibility":3},{"url":"https://invezz.com/news/2025/07/28/superrare-nft-art-platform-hacked-730k-rare-tokens-stolen/","name":"invezz.com","type":"other","credibility":3},{"url":"https://crypto.news/superrare-nft-platform-loses-730k-in-rare-token-exploit/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.thecoinrepublic.com/2025/07/28/superrare-hack-730k-stolen-in-staking-exploit-with-frontrun-twist/","name":"thecoinrepublic.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the July 28, 2025 exploit, SuperRare initiated an incident response. The platform froze affected accounts and engaged cybersecurity firms and third-party auditors to review its broader codebase. SuperRare's initial public communications were limited; as of the date of the exploit, the platform had not released a formal post-mortem or detailed remediation plan. By August 5, 2025 — approximately one week after the incident — SuperRare announced it had fully reimbursed the 61 affected wallets and implemented stricter audit protocols, specifically mandating re-audits for all post-audit code modifications. Following this announcement, the RARE token price surged approximately 41% in a 24-hour period, and derivatives trading volume reportedly doubled, indicating restored market confidence. The response timeline and full compensation of affected users was noted as a positive signal; however, observers and security researchers noted that the vulnerability itself was a preventable logic error that should have been caught in pre-deployment auditing, raising questions about the rigor of security practices applied to staking contract components relative to core trading infrastructure.","heading":"Incident Response and User Compensation","sources":[{"url":"https://99bitcoins.com/news/altcoins/rare-crypto-leads-gains-as-nft-marketplace-superrare-bounces-strongly-after-hack/","name":"99bitcoins.com","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/superrare-nft-platform-loses-730k-smart-contract-hack-rare-token-dips-12-2507/","name":"ainvest.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/cmc-ai/superrare/latest-updates/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.resonance.security/blog-posts/superrare-gets-rekt-how-a-730k-staking-exploit-became-the-nft-worlds-latest-wake-up-call","name":"resonance.security","type":"other","credibility":3}],"severity":"medium"},{"content":"SuperRare launched the RARE ERC-20 governance token in August 2021, concurrent with its transition toward a DAO model. The token has a total supply of 1 billion RARE, with approximately 820.51 million tokens in circulation as of 2025. RARE token holders participate in governance decisions including: setting curatorial requirements for platform Spaces, approving independent artist admissions, establishing grant programs, and allocating funds from the Community Treasury. The SuperRare DAO Community Treasury is controlled via a 4-of-7 multi-sig wallet managed by a 7-person governance council comprising 1 SuperRare Labs team member, 2 SuperRare Labs investors, and 3 independent community members. Platform commissions and fees are routed to this treasury. RARE token holders may also stake tokens to earn a portion of marketplace fees. The RARE token reached an all-time high of approximately $3.79 on October 11, 2021, coinciding with the broader NFT market peak. By the end of 2022, the token had declined approximately 89% from its peak. The token's market capitalization as of mid-2025 stood at approximately $12.7 million. SuperRare's documentation explicitly characterizes RARE as a 'curation and governance token' and states it 'is not an investment product.' No SEC or CFTC regulatory actions specifically targeting SuperRare or the RARE token have been identified in public records.","heading":"RARE Token and Governance Structure","sources":[{"url":"https://docs.superrare.com/whitepapers/master/the-rare-token","name":"docs.superrare.com","type":"other","credibility":3},{"url":"https://docs.superrare.com/whitepapers/master/the-rare-token/token-distribution","name":"docs.superrare.com","type":"other","credibility":3},{"url":"https://medium.com/superrare/announcing-the-rare-curation-token-and-the-superrare-network-390ff60b50a","name":"medium.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/superrare/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://research.binance.com/en/projects/superrare","name":"research.binance.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The July 2025 exploit revealed a significant gap in SuperRare's smart contract security posture. Security researchers from SolidityScan, Resonance Security, and Blockaid independently analyzed the vulnerability and classified it as a broken access control issue — one of the most fundamental and preventable categories of smart contract vulnerabilities under the OWASP Smart Contract Top 10. The flaw in the updateMerkleRoot() function used inverted boolean logic that effectively granted unrestricted access to any caller, an error detectable through standard automated static analysis tools. The attacker's use of Tornado Cash to fund the exploit wallet 186 days in advance, followed by deployment of a purpose-built exploit contract, indicates professional threat actor behavior rather than opportunistic exploitation. The frontrunner dynamic — where a second actor intercepted the pending exploit transaction and executed it first — indicates exposure of the pending transaction in the public mempool, a risk that could have been mitigated through private transaction submission channels. Following the incident, SuperRare implemented mandatory re-audits for all post-audit code changes, an acknowledgment that the staking contract had been modified after an initial audit without sufficient re-verification. Independent security commentary noted that staking and reward distribution contracts in NFT platforms routinely receive less rigorous auditing attention than primary trading infrastructure, creating exploitable blind spots. No additional vulnerabilities in SuperRare's contracts have been publicly reported as of the time of this investigation.","heading":"Security Practices and Smart Contract Risk Assessment","sources":[{"url":"https://blog.solidityscan.com/superrare-hack-analysis-488d544d89e0/","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://www.resonance.security/blog-posts/superrare-gets-rekt-how-a-730k-staking-exploit-became-the-nft-worlds-latest-wake-up-call","name":"resonance.security","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/superrare-staking-contract-exploited-due-permission-checking-flaw-731k-stolen-rare-tokens-2507/","name":"ainvest.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/1fc06-superrare-nft-exploited-rare-tokens","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://newsletter.blockthreat.io/p/blockthreat-week-31-2025","name":"newsletter.blockthreat.io","type":"other","credibility":3}],"severity":"medium"},{"content":"SuperRare occupies a premium niche in the NFT art market, targeting high-net-worth collectors with an average NFT sale price reported at approximately $7,940 and an estimated total lifetime trading volume of approximately $210 million. This positions it well behind dominant general-purpose NFT platforms by volume but distinguishes it as a high-end curatorial venue. The platform's strict artist vetting — initially conducted entirely by the SuperRare Labs team and later supplemented by community-curated Spaces introduced in 2021 — has historically been cited as a counterfeit and fraud risk mitigation measure. The transition to the Rare Protocol in 2023 further decentralized curatorial authority to RARE token holders. The NFT market broadly experienced a significant contraction in 2022 and 2023, and SuperRare's trading volumes and RARE token price reflected this downturn. The hack in July 2025 and subsequent market recovery suggest the platform retains an active user base and some degree of institutional trust, though the RARE token's market capitalization of approximately $12.7 million as of mid-2025 reflects substantial value erosion from its 2021 highs. The platform's continued operation, user compensation following the exploit, and stated security improvements are positive indicators, though the long-term trajectory of the NFT art market introduces ongoing viability uncertainty.","heading":"Market Position and Platform Viability","sources":[{"url":"https://www.cryptoslam.io/superrare/sales/summary","name":"cryptoslam.io","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/superrare/historical-data/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://milkroad.com/reviews/superrare/","name":"milkroad.com","type":"other","credibility":3},{"url":"https://messari.io/project/superrare/profile","name":"messari.io","type":"other","credibility":3},{"url":"https://99bitcoins.com/news/altcoins/rare-crypto-leads-gains-as-nft-marketplace-superrare-bounces-strongly-after-hack/","name":"99bitcoins.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017","event":"John Crain, Charles Crain, and Jonathan Perkins begin building SuperRare in Brooklyn, working initially without external investment.","source":"","date_original":"2017-01-01"},{"date":"2018","event":"SuperRare officially launches as a curated Ethereum-based NFT art marketplace.","source":"","date_original":"2018-01-01"},{"date":"2021-03","event":"SuperRare raises $9 million Series A led by Velvet Sea Ventures and 1confirmation, with participation from Mark Cuban, Chamath Palihapitiya, Ashton Kutcher, Marc Benioff, Samsung Next, and BlockTower Capital.","source":"","date_original":"2021-03-01"},{"date":"2021-08","event":"SuperRare announces the RARE governance token and the SuperRare DAO, transitioning toward decentralized community governance of the platform.","source":"","date_original":"2021-08-01"},{"date":"2021-10-11","event":"RARE token reaches its all-time high price of approximately $3.79 per token, coinciding with the peak of the broader NFT market.","source":""},{"date":"2022-05-12","event":"RARE token hits an all-time low of approximately $0.1365, reflecting the broader crypto and NFT market downturn.","source":""},{"date":"2023","event":"SuperRare launches the Rare Protocol, further decentralizing curatorial authority to RARE token holders through community-governed Spaces.","source":"","date_original":"2023-01-01"},{"date":"2025-01-22","event":"The eventual exploit attacker funds their wallet via Tornado Cash approximately 186 days before the July 2025 attack, indicating premeditated planning.","source":""},{"date":"2025-07-28","event":"SuperRare's RareStakingV1 contract (0xfFB512B9176D527C5D32189c3e310Ed4aB2Bb9eC) is exploited via a broken access control vulnerability in the updateMerkleRoot() function. A frontrunner intercepts the exploit, stealing approximately 11.9 million RARE tokens (~$731,000). RARE token price drops approximately 12%. Security firms Cyvers Alerts, PeckShield, and Blockaid publicly flag the incident.","source":""},{"date":"2025-07-29","event":"SuperRare freezes affected accounts, engages cybersecurity firms and third-party auditors, and mandates re-audits for all post-audit code modifications.","source":""},{"date":"2025-08-05","event":"SuperRare announces full reimbursement of 61 affected wallets. RARE token surges approximately 41% on the news; derivatives trading volume doubles.","source":""}],"sources_used":[{"url":"https://news.artnet.com/market/superrare-founders-2086177","name":"news.artnet.com","type":"other","archive_url":"http://web.archive.org/web/20251123013250/https://news.artnet.com/market/superrare-founders-2086177","credibility":3,"archive_timestamp":"2025-11-23T01:32:50+00:00"},{"url":"https://www.gemini.com/cryptopedia/superrare-nft-marketplace-superrare-crypto-art-market","name":"gemini.com","type":"other","archive_url":"http://web.archive.org/web/20260416005008/https://www.gemini.com/cryptopedia/superrare-nft-marketplace-superrare-crypto-art-market","credibility":3,"archive_timestamp":"2026-04-16T00:50:08+00:00"},{"url":"https://www.samsungnext.com/blog/why-we-invested-in-superrare-a-digital-art-marketplace","name":"samsungnext.com","type":"other","archive_url":"https://web.archive.org/web/20260829052114/https://www.samsungnext.com/blog/why-we-invested-in-superrare-a-digital-art-marketplace","credibility":3,"archive_timestamp":"2026-08-29T05:21:14+00:00"},{"url":"https://medium.com/superrare/announcing-the-rare-curation-token-and-the-superrare-network-390ff60b50a","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260817142505/https://medium.com/superrare/announcing-the-rare-curation-token-and-the-superrare-network-390ff60b50a","credibility":3,"archive_timestamp":"2026-08-17T14:25:05+00:00"},{"url":"https://blog.solidityscan.com/superrare-hack-analysis-488d544d89e0/","name":"blog.solidityscan.com","type":"other","archive_url":"http://web.archive.org/web/20260512175634/https://blog.solidityscan.com/superrare-hack-analysis-488d544d89e0/","credibility":3,"archive_timestamp":"2026-05-12T17:56:34+00:00"},{"url":"https://www.cryptopolitan.com/superrare-nft-exploited-rare-tokens/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20250925074658/https://www.cryptopolitan.com/superrare-nft-exploited-rare-tokens/","credibility":3,"archive_timestamp":"2025-09-25T07:46:58+00:00"},{"url":"https://www.web3isgoinggreat.com/single/superrare-hack","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260310044427/https://www.web3isgoinggreat.com/single/superrare-hack","credibility":3,"archive_timestamp":"2026-03-10T04:44:27+00:00"},{"url":"https://www.resonance.security/blog-posts/superrare-gets-rekt-how-a-730k-staking-exploit-became-the-nft-worlds-latest-wake-up-call","name":"resonance.security","type":"other","archive_url":"http://web.archive.org/web/20260412031032/https://www.resonance.security/blog-posts/superrare-gets-rekt-how-a-730k-staking-exploit-became-the-nft-worlds-latest-wake-up-call","credibility":3,"archive_timestamp":"2026-04-12T03:10:32+00:00"},{"url":"https://invezz.com/news/2025/07/28/superrare-nft-art-platform-hacked-730k-rare-tokens-stolen/","name":"invezz.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://crypto.news/superrare-nft-platform-loses-730k-in-rare-token-exploit/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20260519010653/https://crypto.news/superrare-nft-platform-loses-730k-in-rare-token-exploit/","credibility":3,"archive_timestamp":"2026-05-19T01:06:53+00:00"},{"url":"https://www.thecoinrepublic.com/2025/07/28/superrare-hack-730k-stolen-in-staking-exploit-with-frontrun-twist/","name":"thecoinrepublic.com","type":"other","archive_url":"http://web.archive.org/web/20251015235848/https://www.thecoinrepublic.com/2025/07/28/superrare-hack-730k-stolen-in-staking-exploit-with-frontrun-twist/","credibility":3,"archive_timestamp":"2025-10-15T23:58:48+00:00"},{"url":"https://99bitcoins.com/news/altcoins/rare-crypto-leads-gains-as-nft-marketplace-superrare-bounces-strongly-after-hack/","name":"99bitcoins.com","type":"other","archive_url":"http://web.archive.org/web/20250916141249/https://99bitcoins.com/news/altcoins/rare-crypto-leads-gains-as-nft-marketplace-superrare-bounces-strongly-after-hack/","credibility":3,"archive_timestamp":"2025-09-16T14:12:49+00:00"},{"url":"https://www.ainvest.com/news/superrare-nft-platform-loses-730k-smart-contract-hack-rare-token-dips-12-2507/","name":"ainvest.com","type":"other","archive_url":"http://web.archive.org/web/20250902045426/https://www.ainvest.com/news/superrare-nft-platform-loses-730k-smart-contract-hack-rare-token-dips-12-2507/","credibility":3,"archive_timestamp":"2025-09-02T04:54:26+00:00"},{"url":"https://coinmarketcap.com/cmc-ai/superrare/latest-updates/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20251028011014/https://coinmarketcap.com/cmc-ai/superrare/latest-updates/","credibility":3,"archive_timestamp":"2025-10-28T01:10:14+00:00"},{"url":"https://docs.superrare.com/whitepapers/master/the-rare-token","name":"docs.superrare.com","type":"other","archive_url":"http://web.archive.org/web/20260309202743/https://docs.superrare.com/whitepapers/master/the-rare-token","credibility":3,"archive_timestamp":"2026-03-09T20:27:43+00:00"},{"url":"https://docs.superrare.com/whitepapers/master/the-rare-token/token-distribution","name":"docs.superrare.com","type":"other","archive_url":"http://web.archive.org/web/20260415060928/https://docs.superrare.com/whitepapers/master/the-rare-token/token-distribution","credibility":3,"archive_timestamp":"2026-04-15T06:09:28+00:00"},{"url":"https://coinmarketcap.com/currencies/superrare/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260812113135/https://coinmarketcap.com/currencies/superrare/","credibility":3,"archive_timestamp":"2026-08-12T11:31:35+00:00"},{"url":"https://research.binance.com/en/projects/superrare","name":"research.binance.com","type":"other","archive_url":"https://web.archive.org/web/20260829230902/https://www.binance.com/en/research/projects/superrare","credibility":3,"archive_timestamp":"2026-08-29T23:09:02+00:00"},{"url":"https://www.ainvest.com/news/superrare-staking-contract-exploited-due-permission-checking-flaw-731k-stolen-rare-tokens-2507/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptorank.io/news/feed/1fc06-superrare-nft-exploited-rare-tokens","name":"cryptorank.io","type":"other","archive_url":"http://web.archive.org/web/20251110071558/https://cryptorank.io/news/feed/1fc06-superrare-nft-exploited-rare-tokens","credibility":3,"archive_timestamp":"2025-11-10T07:15:58+00:00"},{"url":"https://newsletter.blockthreat.io/p/blockthreat-week-31-2025","name":"newsletter.blockthreat.io","type":"other","archive_url":"http://web.archive.org/web/20251214022202/https://newsletter.blockthreat.io/p/blockthreat-week-31-2025","credibility":3,"archive_timestamp":"2025-12-14T02:22:02+00:00"},{"url":"https://www.cryptoslam.io/superrare/sales/summary","name":"cryptoslam.io","type":"other","archive_url":"https://web.archive.org/web/20260830034622/https://www.cryptoslam.io/superrare/sales/summary","credibility":3,"archive_timestamp":"2026-08-30T03:46:22+00:00"},{"url":"https://coinmarketcap.com/currencies/superrare/historical-data/","name":"coinmarketcap.com","type":"other","archive_url":"https://web.archive.org/web/20260829074129/https://coinmarketcap.com/currencies/superrare/historical-data/","credibility":3,"archive_timestamp":"2026-08-29T07:41:29+00:00"},{"url":"https://milkroad.com/reviews/superrare/","name":"milkroad.com","type":"other","archive_url":"http://web.archive.org/web/20260521174124/https://milkroad.com/reviews/superrare/","credibility":3,"archive_timestamp":"2026-05-21T17:41:24+00:00"},{"url":"https://messari.io/project/superrare/profile","name":"messari.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:22.078724+00:00","updated_at":"2026-08-30T03:54:59.408899+00:00"}}