On July 28, 2025, SuperRare RareStakingV1 contract was exploited for ~$730K (11.9M RARE) via broken access control in updateMerkleRoot(). Attacker submitted malicious Merkle roots for fraudulent token claims; a frontrunner later hijacked the exploit.

According to monitoring by SlowMist's MistEye security system, the NFT platform SuperRare was exploited. The root cause of the vulnerability was an incorrect permission check in the updateMerkleRoot function, which allowed anyone to modify the Merkle Root and claim tokens.