# Claim hooks incorrectly decode hook data

SuperExecutorBase decodes 24 bytes of yield-source metadata from all Inflow/Outflow hook data, but claim hooks use a different layout, so reward claims always revert.

- Payout: Contest reward
- Severity: high
- Program: Superform
- Credited: T1MOH
- Disclosed: 2025-07-17
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_may2025.pdf#3.1.6
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.6
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:high tech:evm tech:solidity vuln:business-logic

**Target:** SuperExecutorBase / claim reward hooks (Fluid, Gearbox, Yearn)
**Root cause:** _updateAccounting unconditionally extracts yieldSourceOracleId (4 bytes) and yieldSource (20 bytes) from the first 24 bytes of hookData for INFLOW/OUTFLOW hooks, but claim hooks encode only the yield source address at offset 0, so decoding misreads the data and execution fails.
**Steps:**
1. Call a claim hook (e.g. GearboxClaimRewardHook) whose build() encodes only `farmingPool` at offset 0
2. SuperExecutorBase._updateAccounting sees hookType INFLOW/OUTFLOW and calls extractYieldSourceOracleId/extractYieldSource on hookData
3. First 4 bytes are interpreted as oracleId and next 20 as yieldSource, producing garbage values
4. Claim execution reverts, blocking reward claims
**How found:** Code review comparing the generic hookData decoding in SuperExecutorBase against the differing build() data layouts of Fluid/Gearbox/Yearn claim hooks.
**Insight:** When a base executor imposes a fixed metadata prefix on hook data, audit every hook implementation's build() encoder for layout mismatches—claim/reward hooks that skip the prefix will silently break.