July 29, 2025
5 min read
Adrian Zmudzinski
A 31K exploit in SuperRare’s staking contract was caused by a basic access control bug detectable by unit tests or ChatGPT.
SuperRare $730,000 Exploit Caused by Easily Preventable Access Control Bug
NFT trading platform SuperRare recently experienced a significant $730,000 exploit, attributed to a fundamental smart contract vulnerability. Experts in the field have highlighted that this issue could have been readily identified and prevented with standard testing and code review practices. The exploit targeted SuperRare’s (RARE) staking contract, resulting in the theft of approximately $731,000 worth of RARE tokens, as reported by crypto cybersecurity firm Cyvers. The root cause of the vulnerability was a flawed access control mechanism within a function designed to restrict Merkle root modifications—a crucial component for tracking user staking balances—to authorized addresses only. However, the implementation error allowed any address to interact with this sensitive function. 0xAw, lead developer at Alien Base, pointed out the simplicity of the error, noting that even AI like ChatGPT could have detected it. A verification by Cointelegraph confirmed that OpenAI's GPT-4 model successfully identified the flaw when tested. "ChatGPT would’ve caught this, any half-competent Solidity dev would’ve caught this. Basically anyone, if they looked. Most likely nobody did," 0xAw remarked. SuperRare co-founder Jonathan Perkins confirmed that no core protocol funds were lost and assured that affected users would be compensated. He stated that approximately 61 wallets were impacted by the exploit. Perkins added, "We’ve learned from it, and now future changes will go through a much more robust review pipeline."Anatomy of the Vulnerability
The smart contract contained logic that checked if the interacting address was not a specific authorized address or the contract owner before permitting a Merkle root change. This inverted logic inadvertently created a loophole, allowing unauthorized users to drain staked RARE tokens from the contract. A senior engineer at Nexus Mutual commented that "unit tests would have caught this mistake." Similarly, Mike Tiutin, blockchain architect and CTO at AMLBot, described it as "a silly mistake of the developer that was not covered by tests (that’s why full coverage is important)." Slava Demchuk, CEO of AMLBot, emphasized the importance of rigorous smart contract auditing, citing the SuperRare incident as a classic example of the severe consequences that even minor coding errors can have in decentralized systems. "This stands as a stark reminder: in decentralized systems, even a one-character mistake can have severe consequences," Demchuk stated. Perkins acknowledged that despite prior audits and unit tests, the bug was introduced late in the development cycle and was missed in the final testing phases, stating, "It’s a painful reminder of how even small changes in complex systems can have unintended consequences."The Importance of Unit Testing
Unit tests are automated checks designed to verify the correct functioning of individual components of a program. In this scenario, automated tests specifically designed to confirm which addresses were permitted to modify the Merkle root would have failed due to the flawed logic, thereby preventing the exploit. Demchuk elaborated, "By oversight or inadequate testing, the effect was the same: an avoidable vulnerability that cost massively." 0xAw further highlighted the issue as a "apparently complete lack of testing," noting that "This code just does the opposite of what you expect." In response to the incident, SuperRare has implemented new workflows that mandate re-audits for any post-audit code modifications, regardless of their size.Most Vulnerabilities Are Oversights
0xAw characterized the SuperRare exploit as a "normal human error" that had "monumental" consequences by reaching production. He also noted that many serious vulnerabilities often stem from simple and preventable mistakes, even if they are not as immediately obvious as the one in SuperRare's contract. Yehor Rudytsia, Hacken's head of incident response, concurred that thorough test coverage would have easily caught the flaw, stating, "If reviewing this function, it’s a pretty obvious bug."Explore more articles like this on Cointelegraph.
Source: SuperRare $730,000 exploit was easily preventable — Experts weigh in on July 29, 2025.