SuperStaker holds no
WETH, nor any debt. Zero TVL. This is by design.
At the end of your SuperStaker transaction, you have stETH supplied to Aave and you have debt provided by Aave. SuperStaker does not act a vault, as some protocols do. SuperStaker does not issue shares, you hold only Aave issued tokens. As such, the SuperStaker contract does not hold funds that could be compromised by a malicious hacker.
The first step is for you to "approve delegation", which means that you are giving SuperStaking the ability top incur debt on your behalf. That said, note that Aave will not let you incur debt if you are not also holding sufficient collateral. So you are basically saying: If SuperStaker provides me with enough collateral, then SuperStaker can incur this specific amount of debt on my behalf.
The final step that the SuperStaker transaction takes is to deposit the stETH collateral with Aave, to cover the debt. This deposit is sent to Aave on your behalf, meaning that Aave credits your address with the deposit and issues
aSTETHtokens to you directly.