# SuperRare: missing access control on updateMerkleRoot drains staking rewards

SuperRare's staking contract lacked access control on updateMerkleRoot, letting attacker set fake root and claim all 11.9M RARE tokens.

- Payout: Real-world hack
- Severity: critical
- Program: SuperRare
- Credited: DeFiHackLabs
- Disclosed: 2025-07-28
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/SuperRare_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250728-superrare
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control

**Target:** ERC1967Proxy staking contract
**Root cause:** The updateMerkleRoot function was publicly callable without any access control, allowing anyone to set an arbitrary Merkle root.
**Steps:**
1. Call `updateMerkleRoot(fakeRoot)` on the staking contract at `0x3f4D749675B3e48bCCd932033808a7079328Eb48` with a root controlled by attacker.
2. Call `claim(stakingContractBalance, [])` with an empty proof to claim all RARE tokens held by the contract.
3. Transfer claimed tokens to attacker.
**Exploitation:** Attacker deployed a contract that called updateMerkleRoot with a fake root, then called claim with the entire contract balance and an empty proof, draining 11,907,874.713 RARE tokens (~$730K).
**Insight:** Always verify that Merkle root update functions are protected by access control (e.g., onlyOwner) in staking or airdrop contracts; a single missing modifier can allow draining all funds.