Skip to main content
Superform has been reviewed by multiple independent security firms across both core and periphery contracts. The protocol enforces security at multiple layers: onchain Merkle verification for keeper operations, timelocked governance updates, circuit-breaker PPS validation, role-based access control, and continuous invariant monitoring.

​
Audits

​
v2-core

​
v2-periphery

All critical properties and invariants are tested through the GetRecon invariant suite using both Echidna and Medusa across >100 million runs, and continuously monitored through Tenderly.

​
Security Model

​
Dual Merkle Hook Validation

All keeper operations are gated by a dual Merkle tree system. A hook can only execute if the exact combination of hook address + parameters matches a leaf in one of two onchain roots: Both hook-root flows pass through the aggregator’s configurable hook-root timelock. Protocol governance can update that delay.

​
PPS Oracle Security

Price-per-share updates pass through multiple validation layers before acceptance:
  1. ECDSAPPSOracle validates EIP-712 signatures, quorum (≥ 2/3 weighted stake), and nonce binding
  2. SuperVaultAggregator checks future timestamps, pause state, and staleness
  3. Strategy-level checks enforce monotonicity, rate limiting, deviation bounds, dispersion thresholds, and upkeep balance
Strategies are automatically paused when:
  • PPS dispersion exceeds threshold (high standard deviation among validator submissions)
  • PPS deviation is too large (absolute change from current onchain value)
  • Validator participation rate falls below minimum
  • Updates are stale beyond the configured window

​
Access Controls

​
Timelock Protections

​
Emergency Controls

Strategy Pausing — Both primary and secondary managers can pause strategies immediately. Unpausing marks PPS as stale until a fresh oracle update is posted. Banned Hook Leaves — Individual Merkle leaves can be banned without regenerating the entire tree. This provides an immediate block on specific hook + parameter combinations. Guardian Controls — Guardians retain emergency intervention powers such as pause controls, allowing rapid response to detected threats. Emergency Withdrawals — Managers can perform emergency withdrawals through authorized hooks. Expanding that authorization still requires a hook-root proposal and execution flow before new leaves become active.