Perennial V2 Update 3 audit
Audit competition · firm’s term: public contest
Sherlock reviewed Perennial (Perennial V2 Update 3 audit) on 13 Sep 2024: 21 findings, 0 critical; 18 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 5 |
| Medium | 0 | 1 | 13 |
| Low | 0 | 0 | 0 |
HighLack of access control in the MarketFactory.updateExtension() function.Fixed
The report gives no description here.
HighMaliciously specifying a very large intent.price will result in a large gain at settlement, stealing fundsFixed
The report gives no description here.
HighMarket coordinator can liquidate all users in the marketFixed
The report gives no description here.
HighMarket coordinator can set staleAfter to a huge value allowing anyone to steal all market collateral when there are no transactions for some timeFixed
The report gives no description here.
HighPerennial account users with rebalance group may suffer a donation attackFixed
The report gives no description here.
Medium_ineligible() redemptionEligible is miscalculatedFixed
The report gives no description here.
MediumAnyone can cancel other accounts nonces and groups, leading to griefing their Intents.Fixed
The report gives no description here.
MediumController's core function of Rebalance will not rebalance when rebalance is needed in some cases, breaking core functionalityFixed
The report gives no description here.
MediumCorrupted storage after upgrade in the MarketFactory contract.Fixed
The report gives no description here.
MediumKeepers can lose compensation feeFixed
The report gives no description here.
Show 8 more
MediumMarket coordinator can set proportional and adiabatic fees much higher than limited by protocol due to fixed point truncationFixed
The report gives no description here.
MediumMultiInvoker and Manager orders execution can be DOS in key moments if AAVE/Compound utilization is at 100%Fixed
The report gives no description here.
MediumMultiInvoker, Manager and Account unexpected reverts in certain conditions due to AAVE reverting on deposits and withdrawals with 0 amountFixed
The report gives no description here.
Mediumsettle() asyncFee is left in the KeepFactory and is not transfer to the keeper.Fixed
The report gives no description here.
MediumThe Market.migrate() function has no effect and does not migrate PositionStorageGlobal to the new storage layout, breaking the migration assumption.Fixed
The report gives no description here.
MediumThe RiskParameter.liquidationFee variable is not treated and validated as a percentage value, leading to breaking protocol invariants.Fixed
The report gives no description here.
MediumTriggerOrder.notionalValue() Using the wrong latestPositionLocal to calculate the value causes the user to overpay feesFixed
The report gives no description here.
Mediumwhen ReserveBase undercollateralized , Manager.orders will not be able to executeFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Perennial’s security record
PerennialSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us