# _checkAndLockForSuperPosition is not locking the assets in the vaultBank

SuperExecutor approves the vault bank but never locks assets, letting users mint unbacked SuperPositions on the destination chain and drain other depositors' funds.

- Payout: Contest reward
- Severity: high
- Program: Superform
- Credited: Christoph Michel
- Disclosed: 2025-07-17
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** SuperExecutor cross-chain deposit flow (SuperExecutorBase.sol)
**Root cause:** The cross-chain path only creates the vault bank approval but omits the actual lockAssets call, so no funds are locked on the source chain while the SuperPositionMintRequested event is still emitted.
**Steps:**
1. Call the SuperExecutor cross-chain deposit path with a vault bank and destination chain set in the hook.
2. Observe the executor grants token approval to the vault bank but never calls lockAssets.
3. Confirm SuperPositionMintRequested is still emitted despite no locked funds.
4. Bridge assets back and repeat to accumulate SuperPositions on the destination chain.
5. Redeem SuperPositions on the source chain to withdraw funds locked by other users.
**How found:** Code review of SuperExecutorBase.sol against its own docstring, which lists approval then lock as two steps; the implementation only performed the approval.
**Exploitation:** Attacker repeatedly deposits via the cross-chain executor, receiving SuperPositions on the destination chain without locking source-chain funds, then bridges back and repeats to inflate position, finally redeeming against the vault bank's real deposits.
**Escalation:** Repeat deposit/bridge cycle to scale unbacked SuperPositions until vault bank insolvency.
**Insight:** When a function's NatSpec enumerates ordered steps, diff each documented step against the code — missing state-mutating steps after an approval are a common source of unbacked-mint bugs in cross-chain executors.