Superfluid

Superfluid is an asset streaming protocol that has the power to describe cash flows and execute them automatically on-chain over time in a non-interactive way. Superfluid streams are programmable, composable and modular. The first cash flow type allows constant streams of value and one-to-many distributions. All streams are settled at the same time, based on block timestamps. No capital is locked up, and all inflows and outflows are netted in real time, drastically increasing capital efficiency. With a single on-chain transaction, the money will flow from your wallet to the receiver in real time! No further transactions required - it works like magic.

Superfluid enables:

• Real money streaming - constant token flows on-chain with no capital lockups.
• Rewards distributions - Fixed cost distribution in a single transaction for any number of receivers.
• Anything you can imagine - Superfluid is a flexible developer toolbox to build entirely new applications.

For more information about Superfluid, please visit https://www.superfluid.finance.

This bug bounty program is focused on their smart contracts and is focused on preventing:

• Superfluid framework bugs
• Bugs in CFA/IDA in general
  • Anything that would avoid streams from being closed
  • Anything that would result in the sum of all account balances drifting significantly from the total supply
• Theft of tokens in third party wrapper contracts
• Other unexpected behaviour in any of their token contracts

Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.2. This is a simplified 5-level scale, with separate scales for websites/apps and smart contracts/blockchains, encompassing everything from consequence of exploitation to privilege required to likelihood of a successful exploit.

Critical/High smart contract reports must come with a PoC with an end-effect impacting an asset-in-scope in order to be considered for a reward. Explanations and statements are not accepted as PoC and code is required.

This program has the following severity classification and reward structure. In cases where this conflicts with Immunefi’s own classification system, the structure below will be followed.

Critical: Reward - USD 30 000 - USD 100 000

• A reproducible vulnerability discovered in the core protocol that can be exploited by anyone that results in the loss of a portion or all user funds in the Superfluid protocol:
  • Critical bug which results in the drainage of all user funds (USD 100 000).
  • Critical bug which results in the drainage of a portion of user funds (USD 30 000 + 15% of user funds at risk or stuck, up to USD 100 000).

High: Reward - USD 10 000 - USD 30 000

• A reproducible bug by anyone that results in the core protocol not functioning properly where funds are stuck. If funds are stuck: you get a base reward of USD 10 000 + 15% of the total amount of funds that are stuck.
  • If not reproducible (requires special conditions which can’t be affected by anyone): USD 10 000 + 7.5% of the total amount of funds that are stuck

Medium: Reward - USD 5 000

• An unknown vulnerability which results in any of the Superfluid contracts consuming unbounded gas for any operation.

Low: Reward - USD 2 000

• A vulnerability that causes any of the contracts to behave in an unintended manner (which leads to a negative user experience) without resulting in loss of user funds or user funds being stuck.

Gas griefing attacks in general are classified as Low severity.

The following known issues are considered to be out of scope:

• Gas griefing specifically by spam attacks
• Gas griefing specifically in SuperApp termination callbacks
• Re-entrance issues:
  • SuperApp framework allowing callbacks
  • Super Token is ERC-777, which also allows callbacks

Rewards for critical vulnerabilities are further capped at 15% of economic damage, with the main consideration being the funds affected in addition to PR and brand considerations, at the discretion of the team. However, there is a minimum reward of USD 30 000 for Critical bug reports.

Superfluid requires bug bounty hunters to pass a successful KYC screening in order to be eligible for rewards. By submitting a report, bug bounty hunters agree to share the following information: Name, Surname, Address, Citizenship Country, Wallet Address. The collection of this information will be done by Superfluid Finance Ltd.

Payouts are handled by Superfluid directly and are denominated in USD. However, payouts are done in USDC.

Smart Contract

All smart contracts of Superfluid can be found at https://github.com/superfluid-finance/protocol-monorepo/tree/dev/packages/ethereum-contracts/. However, only those in the Assets in Scope table are considered as in-scope of the bug bounty program.

The following vulnerabilities are excluded from the rewards for this bug bounty program:

• Attacks that the reporter has already exploited themselves, leading to damage
• Attacks requiring access to leaked keys/credentials
• Attacks requiring access to privileged addresses (governance, strategist)

Smart Contracts and Blockchain

• Incorrect data supplied by third party oracles
  • Not to exclude oracle manipulation/flash loan attacks
• Basic economic governance attacks (e.g. 51% attack)
• Lack of liquidity
• Best practice critiques
• Sybil attacks
• Spam attacks
• Centralization risks

The following activities are prohibited by this bug bounty program:

• Any testing with mainnet or public testnet contracts; all testing should be done on private testnets
• Any testing with pricing oracles or third party smart contracts
• Attempting phishing or other social engineering attacks against our employees and/or customers
• Any testing with third party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
• Any denial of service attacks
• Automated testing of services that generates significant amounts of traffic
• Public disclosure of an unpatched vulnerability in an embargoed bounty