Superform Competition

The competition at a glance:

• November 27th 20:00 UTC to December 18th 20:00 UTC
• $140,000 total prize pool.

Prize distribution and scoring

The prize distribution works as follows:

• Security reviewers will score points for each finding.
• Prizes are distributed proportionally to the number of points scored.
• A High Severity is worth 10 points, and a Medium Severity 3 points.
• Duplicate findings will be resolved using the following scoring formula that incentivizes unique findings:
  • Each duplicate finding will be scaled down by 0.9n−1/n0.9^{n - 1} / n0.9n−1/n, where nnn is the number of duplicates.
• 10K USDC of the prize pot is reserved for Low Severity or Informational findings. These reports are judged based on quality and researchers are ranked from 1st to 5th for the purpose of prize allocation:
  • 1st: $5,000
  • 2nd: $2,500
  • 3rd: $1,250
  • 4th: $625
  • 5th: $625

Scope

Check out the previously recorded read through of the repos for both competitions on cantina twitter and here.

ERC1155A

• Repository: superform-xyz/ERC1155A
• Commit: e7d53f306989ba205c779973d1b5e86755a1b9c0
• Total LOC: 388
• Files: all files in src

File	Blank	Comment	Code
src/ERC1155A.sol	100	132	362
src/aERC20.sol	10	7	26
SUM:	110	139	388

Superform Core

• Repository: superform-xyz/superform-core
• Commit: 29aa0519f4e65aa2f8477b76fc9cc924a6bdec8b
• Total LOC: 6470
• Files: all files in src

File	Blank	Comment	Code
src/BaseRouterImplementation.sol	143	136	773
src/crosschain-data/extensions/CoreStateRegistry.sol	140	130	740
src/payments/PaymentHelper.sol	147	134	574
src/crosschain-data/utils/PayloadHelper.sol	60	28	339
src/crosschain-liquidity/DstSwapper.sol	75	54	324
src/forms/ERC4626FormImplementation.sol	77	65	279
src/SuperPositions.sol	80	71	249
src/crosschain-data/adapters/layerzero/LayerzeroImplementation.sol	59	60	235
src/settings/SuperRegistry.sol	58	77	215
src/BaseForm.sol	55	59	204
src/crosschain-data/extensions/TimelockStateRegistry.sol	48	48	195
src/SuperformFactory.sol	58	55	191
src/crosschain-liquidity/lifi/LiFiValidator.sol	27	59	171
src/SuperformRouter.sol	31	23	155
src/forms/ERC4626TimelockForm.sol	33	47	153
src/crosschain-data/adapters/wormhole/automatic-relayer/WormholeARImplementation.sol	44	50	153
src/crosschain-data/adapters/wormhole/specialized-relayer/WormholeSRImplementation.sol	46	59	151
src/types/DataTypes.sol	26	39	149
src/crosschain-data/adapters/hyperlane/HyperlaneImplementation.sol	46	57	145
src/settings/SuperRBAC.sol	35	70	120
src/crosschain-data/BaseStateRegistry.sol	41	48	115
src/crosschain-data/BroadcastRegistry.sol	28	32	97
src/payments/PayMaster.sol	28	29	82
src/forms/ERC4626KYCDaoForm.sol	14	23	76
src/EmergencyQueue.sol	28	31	74
src/libraries/DataLib.sol	10	17	73
src/crosschain-liquidity/socket/SocketValidator.sol	17	30	72
src/BaseRouter.sol	21	29	65
src/forms/ERC4626Form.sol	12	18	56
src/crosschain-liquidity/socket/SocketOneInchValidator.sol	17	26	54
src/libraries/PayloadUpdaterLib.sol	10	6	49
src/crosschain-liquidity/BridgeValidator.sol	10	18	46
src/libraries/ArrayCastLib.sol	10	3	37
src/crosschain-liquidity/LiquidityHandler.sol	8	19	30
src/libraries/ProofLib.sol	5	2	16
src/crosschain-data/utils/QuorumManager.sol	7	17	13
SUM:	1554	1669	6470

Out of Scope issues

Any findings on the previous review will be out of scope.

On top of that, automated findings from 4nalyzer will also be considered out of scope.