Forged Transaction Context Lets Attacker Drain $8.7 Million From Superfluid

On February 8, 2022, at 06:17 UTC, an attacker exploited a vulnerability in Superfluid, a Polygon-based protocol for streaming crypto payments, extracting roughly $8.7 million in various assets.

Because several unrelated projects relied on Superfluid's streaming infrastructure for contributor payroll or investor escrow arrangements, the damage rippled beyond Superfluid itself: as the attacker liquidated stolen tokens on the open market, the native assets of those projects took sharp hits. Affected tokens included Mai Finance (QI), Stacker Ventures (STACK), Stake DAO (SDT), and Museum of Crypto Art (MOCA).

QI absorbed the worst of it, initially dropping close to 80% before recovering to roughly 62% of its pre-attack price.

Superfluid contributor @francescorenzia told rekt.news that the attacker focused specifically on wallets holding the largest balances. In the window before the bug was patched, meaningful amounts of ETH, USDC, and DAI were left untouched — the team's interpretation being that the attacker had simply taken enough.

01The exploit, by the numbers

Attacker address (Polygon): 0x1574f7f4c9d3aca2ebce918e5d19d18ae853c090

Exploit transaction: 0xdee86cae2e1bab16496a49b2ec61aae0472a7ccf06f79744d42473e96edd6af6

Assets removed:

• 19.4M QI (worth about $24M before the hack), liquidated across four separate transactions totaling roughly 2,300 WETH (~$6.2M)
• 24.4 WETH (~$76,000)
• 563,000 USDC, swapped for 173 WETH
• 45,000 SDT, swapped for roughly 17 WETH (~$54,000)
• 24,000 STACK, swapped for roughly 6.2 WETH (~$19,000)
• 39,000 sdam3CRV, converted to am3CRV and then into roughly 44,000 amDAI
• 1.5M MOCA, of which 1M was sold for 173 WETH (~$500,000)
• 11,000 MATIC, left unsold

Total taken: approximately $8.7 million.

About six hours after the attack, Superfluid — with help from Mudit Gupta — shipped a patch closing the hole.

The technical explanation that follows is drawn from Superfluid's own post-mortem.

02Where the flaw lived

Superfluid.sol, the protocol's host contract, is what allows different Superfluid agreements — the Constant Flow Agreement and the Instant Distribution Agreement — to be composed together within a single transaction; systems built this way are known as Super Apps.

To maintain a consistent, trusted state as execution passes between agreement calls, Superfluid relies on a construct called "ctx": a serialized state object managed by the host contract. Ctx carries everything an agreement function needs to know about the call in progress, most critically the identity of the original caller — the msg.sender.

That identity field is precisely what the attacker manipulated. By carefully crafting the calldata, they created a mismatch between how the host contract serialized the ctx and how the agreement contract later deserialized it, causing the agreement contract to act on a forged context object that impersonated other users' accounts. Using this technique, the attacker generated IDA indexes on behalf of accounts they did not control, redirecting those accounts' funds to themselves.

03Inside the exploit contract

A proof-of-concept exploiter contract shows how the bug could be used to impersonate another account and shut down its open payment streams. In the actual exploit transaction, the same underlying technique was applied against the IDA contract to pull funds directly out of victims' accounts.

Tracing the call chain:

deleteAnyFlowBad — Calls to callAgreement conventionally pass a placeholder ctx value, which the agreement's own Solidity code later reads back as its "ctx" argument (background on this pattern is available in Superfluid's placeholder-ctx documentation). This is the entry point the attacker used to inject a forged ctx carrying an arbitrary sender address.

Superfluid.callAgreement — Under normal conditions, this function generates the ctx and stamps it, storing a hash of it in a state variable so it can later be checked against Superfluid.isCtxValid.

ConstantFlowAgreementV1.createFlow — The agreement calls AgreementLibrary.authorizeTokenAccess to confirm the calling host contract is authorized to make state-changing calls on the relevant token contract.

AgreementLibrary.authorizeTokenAccess — Once the host is authenticated, the agreement contract extends that same trust to the ctx it received, decoding (deserializing) it into memory without additional checks.

That last step is where things broke down. Within the malicious deleteAnyFlowBad call, a fake ctx could be smuggled in. After Superfluid.replacePlaceholderCtx merges everything into a single bytes object — the host contract doesn't inspect agreement-specific data — the resulting payload actually contains two ctx values back to back: the legitimate one and the attacker's injected one. When the agreement contract decodes that payload, Solidity's ABI decoder reads only the first value it encounters — the injected one — and silently drops the rest, including the genuine ctx.

Superfluid's fix adds a verification step, ISuperfluid.isCtxValid, inside the agreement contract itself: it checks the decoded ctx's hash against the stamp recorded on the host contract. That check already existed for ctx data arriving via SuperApp callbacks, but had never been applied to ctx data handed over by the (nominally trusted) host contract.

04Aftermath

Superfluid has contacted the attacker on-chain, and according to the post-mortem, a $1 million bounty remains on offer in exchange for returning the funds. The team says most affected accounts have already been made whole, with the larger QI and MOCA losses to be reimbursed on a longer timeline.

By dollar value the incident ranks 42nd on rekt.news' leaderboard and did not result in direct losses of user-custodied funds — its notability comes instead from how it spread into protocols that had nothing to do with the exploit beyond using Superfluid's payment rails. As DAO infrastructure keeps expanding, this kind of indirect exposure looks likely to become a bigger target for the anonymous attackers already common across DeFi.

As of publication, the stolen funds remain sitting in the attacker's wallet. Whether they eventually take the bounty or leave Superfluid empty-handed is still an open question.