Scores/Superform

Superform

FORGED

DeFi · Ethereum · Unknown TVL · 10 contracts

Confidence 82%Z-Factor 0.50Updated 2026-05-13Cross-chain assessedPublic Score

Public risk assessment — scores are produced with the same methodology as monitored protocols

617

BRI Score

3004756508251000

Security Profile

Access Control
42

Economic Soundness
48

Oracle Integrity
52

Compositional Risk
35

Governance
55

Maturity
40

Resilience
25

Supply Chain
60

Liquidity & Market Structure
50

Cross-Chain Messaging
30

Op Security
55

Access Ctrl
42

Economic
48

Oracle
52

Compos.
35

Govern.
55

Maturity
40

Resilience
25

Supply Ch.
60

Liquidity
50

X-Chain
30

OpSec
55

Min

Avg

Max

Audit History

Bug Bounty Program

Unknown

Max payout on Unknown

Assessment

Cross-chain yield aggregator with 17 validated findings (3 Critical, 8 High) from 6 parallel analysis lenses. F1 class (inspect/build gap) is systemic across hooks — 10 lens cross-confirmations. Pre-mainnet v2 with 6 prior audits that missed these surfaces. BRI lands at low FORGED (602) due to extreme compositional and cross-chain risk partially offset by standard supply chain and governance structures.

Dimension Breakdown

How scores work →

Access Control

Weight 19%88% conf

Concerning

F1 class: inspect()-vs-build() systemic parameter binding gap across 6 hooks
Manager can substitute critical calldata (dstChainId, recipient, lltv, outputAmount)
6 sub-findings (F1a-F1f) with validated PoCs — 10 lens hits across 4 agents
F1a composes with ACK'd H-3.1.2 for SuperPosition supply inflation (Critical)
Manager-as-strategist trust boundary is load-bearing with no on-chain enforcement

Economic Soundness

Weight 14%82% conf

Concerning

F2: maxStaleness has no upper bound — manager sets type(uint256).max to disable PPS gate
F3: updatePPSAfterSkim bypasses 14-property DOD oracle validation
F4: cancel-redeem silently overridden by fulfill — manager captures optionality value
PPS manipulation surfaces compose: F2+F3+Recon M-02 ACK'd PPS-sandwich

Oracle Integrity

Weight 14%80% conf

Concerning

F2: maxStaleness floor-only enforcement — no ceiling on oracle staleness
F3: skim path bypasses validator-network DOD (sets lastUpdateTimestamp directly)
F5: ECDSAPPSOracle uses abi.encodePacked instead of abi.encode for EIP-712
Standard signers produce wrong digest — silent ProofValidationFailed events
Multiple oracle-adjacent surfaces interact with PPS manipulation chain

Battle-Tested Maturity

Weight 13%85% conf

Concerning

v2 not yet deployed to mainnet (Cantina bounty active, pre-launch)
VaultBank still in test/draft — not yet promoted to src/
High velocity of changes across 193-contract surface
6 prior audits (Spearbit, Recon, node.security, etc.) completed on earlier versions

Governance & Upgradeability

Weight 11%75% conf

Moderate

SuperGovernor exists but manager role is over-trusted
maxStaleness floor-only enforcement (no ceiling — cosmology assumption #16)
No on-chain slashing for manager misbehavior (cosmology assumption #12)
Manager-as-strategist can keep staleness clock fresh without validator activity

Adversarial Resilience

Weight 7%92% conf

Critical

6 prior audits (Spearbit, Recon, node.security, etc.) missed these findings
17 validated findings including 3 Critical-class with 10 validated PoCs
F1 class (10 lens cross-confirmation) exploits pattern noted but not enumerated by Spearbit M-5.3.10
F7 is dual surface of node.security M-01 fix — new bug introduced by prior remediation
Very low adversarial resilience despite extensive prior review

Compositional Risk

Weight 5%90% conf

Critical

Extreme composition: hooks compose with cross-chain bridges (Across, DeBridge)
External protocol integrations: Morpho, Ethena, Centrifuge, Pendle, Spectra, Fluid, Gearbox
Internal SuperPosition system creates synthetic cross-chain positions
F1 class directly exploits composition boundary between inspect() and build()
193 contracts across v2-core and v2-periphery

Supply Chain

Weight 4%70% conf

Moderate

Standard dependencies: OpenZeppelin, forge-std, solady
No exotic or unaudited supply chain dependencies
Substrate/Solidity mixed stack but standard patterns
Moderate dependency complexity from multi-protocol integrations

Cross-Chain Messaging

Weight 4%88% conf

Critical

Cross-chain is CORE to SuperForm architecture — not optional
F1a/F1e/F1f directly exploit cross-chain bridge hook calldata binding gaps
Multiple bridge integrations: Across, DeBridge, Circle CCTP
SuperPositions create synthetic cross-chain receipt tokens
Bridge message replay and destination chain substitution surfaces validated

Liquidity & Market Structure

Weight 2%60% conf

Concerning

Pre-mainnet: TVL not yet established for v2
v1 had moderate TVL but v2 is a complete redesign
Neutral score — insufficient on-chain data for liquidity assessment

Operational Security

Weight 2%65% conf

Moderate

Standard multisig/team operational setup
No specific opsec findings from sprint analysis
Pre-mainnet reduces current operational attack surface

Additional Dimensions

Cascade Exposure

Weight conditional0% conf

-1

Critical

Not assessed — excluded from BRI computation

Risk Drivers

Primary risk factors driving this score, ordered by severity.

Adversarial Resilience25

Cross-Chain Messaging30

Compositional Risk35

Adversarial Risk Signals

Observable security posture indicators. These signals reflect publicly verifiable information and responsible disclosure outcomes. No specific vulnerability details are exposed.

Disclosure HistoryNot Assessed

Remediation VelocityNot Assessed

Bug Bounty ProgramNot Assessed

Audit CoverageNot Assessed

Incident HistoryNot Assessed

Deployed UnknownZ-Factor 0.50011 active dimensions

Score History & Verification

Score provenance tracking begins with the next reassessment.

On-Chain Data

Protocol Slug: "superform"
Oracle: BRORegistry (Base)
Evidence: IPFS (pinned)
Staleness Threshold: 24 hours

Read Score

registry.getScore("superform")

Reduce exploitable risk

BlackHart Monitoring provides continuous adversarial analysis, vulnerability detection, remediation support, and verified reassessment when your risk posture improves.

View Monitoring Plans How Scores Work

Believe this score contains a factual error? Submit evidence for review →