Skip to main content

A Single Line of Code Cost SuperRare $730K: How Bug Hunter Could Have Prevented the Hack

· 4 min read
Bug Hunter Team
Smart Contract Security Engineers

In the world of Web3, security is everything. Yet, time and again, we see major projects fall victim to exploits that, in hindsight, seem devastatingly simple. The recent hack of the NFT platform SuperRare is a textbook example. A vulnerability in their RareStaking contract allowed an attacker to drain approximately $730,000 in RARE tokens.

The most painful part? The exploit stemmed from a single flawed line of code, a logical error that an automated security tool like Bug Hunter could have detected in minutes, long before any damage was done.

Let's break down how the hack happened and how continuous security analysis could have made all the difference.

The Flaw: An Open Door in the Smart Contract​

The vulnerability was located in the updateMerkleRoot function within the RareStakingV1.sol contract. This function was designed to update the contract's Merkle root, a critical piece of data used to verify who is eligible to claim staking rewards. Only the contract owner or another authorized address should have been able to call this function.

The developers attempted to enforce this using a require statement. Unfortunately, a critical logical error rendered the check useless.

Here is the vulnerable line:

require(msg.sender != owner() || msg.sender != address(0xc2f...ddc));

At first glance, it might look like it checks if the sender is one of two authorized addresses. In reality, it does the opposite and fails completely. Here's why:

  • The condition uses an OR (||) combined with negative comparisons. The statement essentially says: "Require that the sender is not the owner or not the authorized address."
  • This condition will always be true for any caller, including attackers:
    • If the caller is the owner, then they are not the other authorized address, so the check passes.
    • If the caller is the authorized address, then they are not the owner, so the check passes.
    • If the caller is a random attacker, they are neither address, so the check passes.

This left a critical, state-changing function completely unprotected. The attacker simply called updateMerkleRoot with a new root they controlled. By doing so, they could generate fraudulent proofs and drain RARE tokens from the staking contract since they now effectively controlled who was eligible for rewards.

How Bug Hunter Pinpoints the Problem​

This is exactly the kind of vulnerability automated security tools are built to find. When we ran the SuperRare codebase through Bug Hunter, it flagged the flawed authorization check within minutes.

Here’s a summary of what Bug Hunter reported:

Severity: High Finding ID: BH-L-superrare-012 Description: The updateMerkleRoot function in RareStakingV1.sol contains an improper authorization check. The require statement uses a logical OR (||) with negative comparisons, allowing any caller to bypass the restriction and execute the function. This permits unauthorized users to modify critical state variables such as currentClaimRoot and currentRound, leading to potential manipulation of the contract’s state and theft of funds.

Bug Hunter's analysis engine is trained to detect incorrect access control patterns. It recognized that updateMerkleRoot modifies sensitive state variables and identified the A != x || A != y pattern as a tautology; a condition that is always true. It immediately flagged it as an "Improper Authorization Check," alerting developers before any exploit could occur.

Bug Hunter reported SuperRare vulnerability

The Simple Fix and the Vital Lesson​

The fix for this multimillion-dollar bug is surprisingly simple. The require statement just needed to use positive comparisons (==) instead of negative ones (!=).

Corrected code:

require(msg.sender == owner() || msg.sender == address(0xc2f...ddc), "Not authorized");

This ensures the function can only proceed if the caller is the owner or is the authorized address.

The SuperRare hack is a powerful reminder that even top-tier projects can fall victim to fundamental mistakes. Manual audits are important, but they are point-in-time checks. Smart contract security must be continuous and integrated directly into the development lifecycle.

Bug Hunter acts as a constant security partner, scanning code on every commit and catching common but critical vulnerabilities before they reach production. In this case, a $730,000 exploit could have been entirely avoided with a few minutes of automated scanning.

Don't wait for an exploit to expose your project's weaknesses. Integrate continuous security analysis into your workflow and build with confidence.