Palpitada security review
Audit · firm’s term: security review
Nethermind Security reviewed Palpitada (Palpitada security review) on 3 Apr 2026: 21 findings, 1 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 7 |
| Low | 0 | 0 | 12 |
CriticalBuy-side liquidity parameter estimation uses stale liquidityParameter instead of the current dynamic bFixed
The report gives no description here.
HighCredit consumption in predict(...) permanently blocks sellingFixed
The report gives no description here.
MediumDiscrepancy in event date enforcement allows front-running of settlementFixed
The report gives no description here.
MediumDynamic fee in direct trades is computed from the taker’s limit price instead of the execution priceFixed
The report gives no description here.
MediumHolding period bypass via stale purchaseTimestamp in predict(...)Fixed
The report gives no description here.
MediumMint/Merge match has no on-chain collateralization enforcementFixed
The report gives no description here.
MediumOrderbookMarket emergency withdrawal does not update market statusFixed
The report gives no description here.
MediumPro-rata usdcSpent deduction on sells enables over-claiming draw refundFixed
The report gives no description here.
MediumTernary draw order can be executed against a different market than the one the maker signedFixed
The report gives no description here.
LowCancelled delayed operations can be re-queued by anyone using on-chain signaturesFixed
The report gives no description here.
Show 10 more
LowCancelled orderbook market can be subsequently resolvedFixed
The report gives no description here.
LowDirect trades do not enforce that limit prices cross before executionFixed
The report gives no description here.
LowEmergency withdrawal does not update market status or prevent subsequent settlementFixed
The report gives no description here.
LowLMSR math double-scales PRBMath exp() outputs, causing premature overflow in pricing and cost calculationsFixed
The report gives no description here.
LowNo signer rotation or removal mechanism after one-time multisig configurationFixed
The report gives no description here.
LowSell-generated protocol and curator fees are locked when a market resolves as a drawFixed
The report gives no description here.
LowsellPosition lacks slippage protection for sellersFixed
The report gives no description here.
LowsetMultisigController in CreditManager does not emit an eventFixed
The report gives no description here.
LowStepwise calculateDynamicB creates price discontinuities at tier boundariesFixed
The report gives no description here.
LowSwitching between manual and dynamic liquidity modes on a live market invalidates pool accountingFixed
The report gives no description here.
Show 1 more
LowTernary market mint/merge operations hardcode all fees and price improvement to the YES positionFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Palpitada’s security record
PalpitadaSecurity firm
Nethermind Security57 projects reviewed · 81 reports · latest Sep 2026
See Nethermind Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us