Audit log

Every state-changing event for Superfluid: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 17:37:56Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,767,122

   sig

   Z5tHb1yQSRTN…8aoXfkancopyexplorer ↗

   hash

   9CWJa8nkEdFi…sr1CbT49copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5439 B) ▸

   {"actor":"system:backfill","investigation_id":"3fa226c1-40b6-4785-9498-9ad2b6d997fb","kind":"publish","page_slug":"superfluid","published_at":"2026-05-28T17:37:56.348Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Superfluid","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/superfluid-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-superfluid-hack-february-2022","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=2022-02-08-2","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/superfluid-blog/08-02-22-exploit-post-mortem-15ff9c97cdd","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/polygon-stablecoin-qidao-exploited-for-13m-on-superfluid-vested-contract","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/qidao-experiences-exploit-of-superfluid-smart-contract-code-20m-estimated-to-be-lost/","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/superfluid-rekt","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/superfluid-blog/strengthening-superfluid-protocol-security-with-additional-third-party-audits-c17c2ca93e73","type":"other","url":""},{"credibility":3,"name":"https://medium.com/superfluid-blog/results-from-halborn-smart-contracts-audit-5070a2945357","type":"other","url":""},{"credibility":3,"name":"https://reports.electisec.tech/reports/06-2022-Superfluid","type":"other","url":""},{"credibility":3,"name":"https://immunefi.com/bug-bounty/superfluid/information/","type":"other","url":""},{"credibility":3,"name":"https://github.com/sherlock-audit/2025-06-superfluid-locker-system","type":"other","url":""},{"credibility":3,"name":"https://audits.sherlock.xyz/contests/648","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/111139/ethereum-money-streaming-protocol-superfluid-raises-9-million-seed","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/278615/ethereum-token-streaming-protocol-superfluid-strategic-funding","type":"other","url":""},{"credibility":3,"name":"https://superfluid.org/post/superfluid-secures-usd5-1m-to-boost-growth","type":"other","url":""},{"credibility":3,"name":"https://www.cbinsights.com/company/superfluid-finance/people","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://superfluid.org/post/introducing-sup-the-superfluid-token","type":"other","url":""},{"credibility":3,"name":"https://icodrops.com/superfluid/","type":"other","url":""},{"credibility":3,"name":"https://www.chaincatcher.com/en/article/2168549","type":"other","url":""}]}],"sources_used":[],"summary":"Superfluid is an asset streaming and programmable cash flow protocol founded in 2020, deployed across Ethereum, Polygon, and multiple other EVM chains. On February 8, 2022, an attacker exploited a context serialization vulnerability in the protocol's host contract, draining approximately $8.7 million in assets from multiple projects including QiDAO, Stake DAO, Stacker Ventures, and Museum of Crypto Art. The protocol patched the vulnerability within hours, partially compensated affected parties, and has continued operating with additional audits and a native SUP token launch in 2025.","timeline":[{"date":"2020-01-01","event":"Superfluid protocol founded by Francesco Renzi, Miao, and Michele D'Aliessi","source":""},{"date":"2021-07-13","event":"Superfluid raises $9 million seed round led by Multicoin Capital","source":""},{"date":"2022-02-08","event":"Attacker exploits context serialization vulnerability in Superfluid host contract, draining approximately $8.7 million from vesting contracts across QiDAO, Stake DAO, Stacker Ventures, and Museum of Crypto Art","source":""},{"date":"2022-02-08","event":"Emergency protocol upgrade deployed within ~4 hours of exploit; $1 million bounty offered to attacker for fund return","source":""},{"date":"2022-02-09","event":"Superfluid recapitalizes 80% of affected addresses with direct USDC transfer within 18 hours; longer-term compensation plan negotiated for remaining losses","source":""},{"date":"2022-06-01","event":"Halborn and yAcademy (Electisec) complete post-exploit security audits; no new critical vulnerabilities found","source":""},{"date":"2024-02-22","event":"Superfluid raises $5.1 million strategic round led by Fabric Ventures","source":""},{"date":"2025-02-19","event":"Superfluid introduces SUP governance token with 1 billion total supply; 60% allocated to community","source":""},{"date":"2025-06-04","event":"Sherlock competitive audit of Superfluid Locker System identifies multiple medium-severity vulnerabilities in SUP staking and vesting contracts","source":""},{"date":"2025-08-05","event":"SUP token lists on Binance Alpha; price declines 25-30% within 24 hours on airdrop sell pressure","source":""},{"date":"2025-11-22","event":"Superfluid Token Generation Event (TGE) concludes","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e81ce9b5-ffe6-4b8a-a5c0-ff71031f01e6copy
2. #2rescoreby systemsystem

   2026-10-10 18:45:09Z
   Score: 38 → 66 (+28)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 66. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −2.4; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 455,364,863

   sig

   5aSg4BZtq16v…PQVg8bLccopyexplorer ↗

   hash

   F9eaZ7gq1k4g…8Ag284Gbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (608 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:45:09.584Z","decision":"rescore","investigation_id":"3fa226c1-40b6-4785-9498-9ad2b6d997fb","new_score":66,"page_slug":"superfluid","prev_score":38,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 66. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −2.4; legitimacy credit long-running +10.","score_delta":28,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 979496b1-d4ad-4307-b41e-eb2c1c5af71dcopy
3. #3acceptby agent:avoid-moderatoranalyzer

   2026-11-03 23:04:49Z
   Score: 66 → 65 (-1)
   CryptoSlate (Sept 10, 2026) reports a Superfluid bug on Celo let an attacker drain over $100K from GoodDollar reserves (86,588 cUSD plus 20,857 XDC), Superfluid says Celo-specific, GoodDollar says reserves not depleted. Matches the note.
   Source:https://cryptoslate.com/a-crypto-project-paying-nearly-1-million-people-a-daily-income-just-had-its-reserves-looted/

   Wayback:archived snapshot2026-09-21 13:35:54Z
   anchoranchored

   chain

   ●mainnet-betaslot 465,077,292

   sig

   4ttH7xQh6nq1…VjPKbwyPcopyexplorer ↗

   hash

   2ibVJBnyMhG2…GugPitdxcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (705 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T23:04:48.852Z","decision":"accept","investigation_id":"3fa226c1-40b6-4785-9498-9ad2b6d997fb","new_score":65,"page_slug":"superfluid","prev_score":66,"reason":"CryptoSlate (Sept 10, 2026) reports a Superfluid bug on Celo let an attacker drain over $100K from GoodDollar reserves (86,588 cUSD plus 20,857 XDC), Superfluid says Celo-specific, GoodDollar says reserves not depleted. Matches the note.","score_delta":-1,"sequence_num":3,"submission_content_hash":"a214ba033421ca2e408d6305ca4be0d9769661b1e011ae3e7fc94c9f7265e1a2","submission_id":"de91b171-917b-4477-a2a6-8af8b99a0a52","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9e52eea2-fb43-4509-b336-e9a1ae7d8aeecopy
4. #4reviewby reviewerreviewer

   2026-11-04 00:53:23Z
   Score: 65 → 65 (no score change)
   The February 2022 exploit narrative is well supported by Rekt (time, amount, address, bounty, compensation). Gaps: the Tornado Cash funding claim is unsupported by the source checked, the SUP allocation figures sum to more than 100% (the source is itself overlapping), and the November 2025 TGE date is unverified. The page omits the September 2026 Celo/GoodDollar exploit, which the accepted submission documents.
   anchoranchored

   chain

   ●mainnet-betaslot 465,107,324

   sig

   5VmW7BihjYPA…odKn26zqcopyexplorer ↗

   hash

   B1dEL8ZpTq7w…TdtQ7q6Qcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1261 B) ▸

   {"actor":"reviewer","artifact_identity":"90eeae5d06d30d9e5bce05a564f9a94e","decided_at":"2026-11-04T00:53:23.588Z","decision":"review","disputed_pct":0.25,"findings_hash":"5iGnE3QKW59fRaSMbG3ZR6ZTwVBCykp9fHE5spayZRyv","investigation_id":"3fa226c1-40b6-4785-9498-9ad2b6d997fb","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":65,"omissions":{"material":1,"total":1},"page_content_hash":"bf94937f16d8b45db02dc025048a8c2b7ea8a2c50bc6e4a70679663afae448a6","page_slug":"superfluid","prev_score":65,"reason":"The February 2022 exploit narrative is well supported by Rekt (time, amount, address, bounty, compensation). Gaps: the Tornado Cash funding claim is unsupported by the source checked, the SUP allocation figures sum to more than 100% (the source is itself overlapping), and the November 2025 TGE date is unverified. The page omits the September 2026 Celo/GoodDollar exploit, which the accepted submission documents.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":4,"subject_status":"operating","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 250fb3b2-efed-4e99-b1fd-495c563bc4b7copy
5. #5review reviseby judgejudge

   2026-11-04 00:53:23Z
   Score: 65 → 65 (no score change)
   Of 8 claims checked, none were disputed and 2 could not be verified (claim_findings[2] Tornado Cash funding, claim_findings[6] November 2025 TGE date), giving 25% by claim count (minor band). The February 2022 exploit core (date, time, amount, attacker address) is confirmed by Rekt. However, the page does not mention the September 2026 Celo/GoodDollar exploit (omission_findings[0], material), and its statement that the protocol continued operating with additional audits is incomplete without it, so the verdict is escalated to the significant band. The SUP allocation figures on the page sum to 135% and omit the foundation line (claim_findings[5]). The reviewer's confidence was moderate (0.5), so the penalty sits in the lower half of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 465,107,329

   sig

   3VGcukurX3C8…ZswJP2KKcopyexplorer ↗

   hash

   7RpNFEKUBxot…RkmpfuXNcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1865 B) ▸

   {"actor":"judge","artifact_identity":"90eeae5d06d30d9e5bce05a564f9a94e","band_override":null,"decided_at":"2026-11-04T00:53:23.588Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.25,"investigation_id":"3fa226c1-40b6-4785-9498-9ad2b6d997fb","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":65,"page_slug":"superfluid","prev_score":65,"reason":"Of 8 claims checked, none were disputed and 2 could not be verified (claim_findings[2] Tornado Cash funding, claim_findings[6] November 2025 TGE date), giving 25% by claim count (minor band). The February 2022 exploit core (date, time, amount, attacker address) is confirmed by Rekt. However, the page does not mention the September 2026 Celo/GoodDollar exploit (omission_findings[0], material), and its statement that the protocol continued operating with additional audits is incomplete without it, so the verdict is escalated to the significant band. The SUP allocation figures on the page sum to 135% and omit the foundation line (claim_findings[5]). The reviewer's confidence was moderate (0.5), so the penalty sits in the lower half of the band.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":5,"severity_override":{"applied":true,"band":"significant","from_band":"minor","reason":"omission_findings[0] is a material omission: a September 2026 exploit in Superfluid's Celo deployment (GoodDollar reserve losses over $100,000) is documented by an accepted submission and a Tier 2 source, and the page's security history stops at 2025. subject_status.contradicts_page is true. The 25% claim-level rate understates this, so the page is judged in the significant band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ffdac725-cc93-4fce-84fc-41f24d22cafacopy