Superposition — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Superposition, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 19
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 19 closed, publicly disclosed Superposition reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Integer overflow / underflow, Logic error, Access control, Price manipulation, across EVM-Solidity, Move. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Integer overflow / underflow findings disclosed against Superposition
- Logic error findings disclosed against Superposition
- Access control findings disclosed against Superposition
- Price manipulation findings disclosed against Superposition
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Superposition: Unintended under/overflow of the amount already swapped in/out due to unmatching logic
In Superposition's Rust-based DEX implementation (Seawater), swap step calculations used standard addition and subtraction operators on signed 256-bit integers (`state.amount_calculated`) inside the swap loop. In Rust release builds, native arithmetic operations on integer types do not panic on overflow or underflow by default unless explicitly checked. This allowed `amount_calculated` to silently wrap around during swap execution, diverging from Uniswap V3's expected math safeguards and leading to incorrect input/output balance accounting.
Superposition: No related function to set `fee_protocol`
Superposition's Seawater pool implementation includes storage state and collection logic for protocol fees, but lacks any administrative function to configure the `fee_protocol` variable. Because the protocol fee percentage remains uninitialized or set to zero with no mechanism to update it, the protocol is permanently unable to accrue or collect trading protocol fees. The issue was resolved by adding a restricted administrative function `set_fee_protocol` callable only by the seawater admin.
Superposition: Volatile pools with higher fee structure cannot be created because of tick_spacing
Superposition's Concentrated Liquidity AMM engine defined the `tick_spacing` variable as an 8-bit unsigned integer (`u8`) in its Rust pool initialization routines. Consequently, pools requiring a tick spacing parameter greater than 255 (such as volatile trading pairs using higher fee tiers exceeding 1.3%) could not be initialized as standard integer conversions or assignments would overflow or revert. This prevented the deployment and operation of high-volatility liquidity pools on the platform.
Superposition: Unrevoked approvals allow NFT recovery by previous owner
A logic error in the NFT contract's transfer logic fails to clear per-token approvals (`getApproved[_tokenId] = address(0)`) when a token changes ownership. Consequently, previously approved operators or former owners retain valid transfer rights over the token post-sale. This enables previous owners or operators to steal back the NFT from the new owner immediately following a transfer or market trade.
Superposition: Missing `lower<upper` check in `mint_position`
Superposition's concentrated liquidity DEX failed to enforce that lower tick bounds are strictly less than upper tick bounds inside `mint_position`. When `lower == upper`, the delta price calculation evaluates to zero token cost while allowing zero-cost liquidity positions to be initialized in storage. An attacker can create thousands of zero-cost positions that alter tick traversal during user swaps, drastically diluting/stealing fee distributions from legitimate liquidity providers.
Superposition: `get_fee_growth_inside` in `tick.rs` should allow for `underflow`/`overflow` but doesn't
Superposition's Rust-based Stylus implementation (`tick.rs`) of Uniswap V3 fee tracking incorrectly utilized checked subtraction (`checked_sub`) when calculating tick fee growth inside positions. Uniswap V3's fee growth tracking mechanism relies fundamentally on modular arithmetic integer overflow/underflow wrapping (i.e. `wrapping_sub`) to maintain correct state across global fee accumulators. Because `checked_sub` returns an error when global fee counters overflow, operations dependent on fee calculations (such as burns, collects, or position updates) would unexpectedly revert, locking liquidity and preventing fee claims.
All reports in this group
- Superposition: Position's owed fees should allow underflow but it reverts instead, resulting in locked fundsInteger overflow/underflow$0
- Superposition: Parameter misordering in fee collection function causes denial of service and fee lossLogic error$0
- Superposition: `bytes data` param is not passed to ERC721 recipient as expected by EIP-721Logic error$0
- Superposition: When performing `swap` and the swap position does not cover `swap amount`, the base price of `sqrt_price` is set incorrectlyLogic error$0
- Superposition: `swapOut` functions have invalid slippage check, causing user loss of fundsLogic error$0
- Superposition: `_onTransferReceived()` does not work as intendedLogic error$0
- Superposition: `decrPosition09293696` will not work due to incorrect function signatureLogic error$0
- Superposition: `swap_2` implementation will randomly revert due to improper check, root cause for failed test `ethers_suite_uniswap_orchestrated_uniswap_two`Logic error$0
- Superposition: Wrong liquidity formula usedLogic error$0
- Superposition: Users can't remove liquidity while a pool is disabledAccess control$0
- Superposition: Lp's liquidity may be lost if re-org happensPrice manipulation$0
- Superposition: `update_emergency_council_7_D_0_C_1_C_58()` updates nft manager instead of emergency councilLogic error$0
- Superposition: If liquidity is insufficient, users may need to pay more tokens in `swap2`Logic error$0