Palpitada security review
Audit · firm’s term: security review
Nethermind Security reviewed Palpitada (Palpitada security review) on 3 Apr 2026: 21 findings, 1 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 7 |
| Low | 0 | 0 | 12 |
Marked Info or Best Practices by the firm. Not counted as findings.
InfoCurator fees are not subject to token-based fee discountsAcknowledged
The report gives no description here.
InfoFee discount can be obtained via flash-loaned tokensAcknowledged
The report gives no description here.
Best PracticesThe depositUSDC(...) function is redundantAcknowledged
The report gives no description here.
InfoThe executeMultisigOperation(...) function bypasses initialization checks for marketFactoryAcknowledged
The report gives no description here.
Best Practices_cancel() in OrderbookMarket does not require ACTIVE statusFixed
The report gives no description here.
Info18-to-6 decimal truncation in sellPosition can burn shares for zero USDCFixed
The report gives no description here.
InfoEIP-2612 permit flow in predict(...) is broken for users with credit balancesFixed
The report gives no description here.
Best PracticesEnum types lack a default sentinel value for uninitialized stateFixed
The report gives no description here.
Best PracticesFee configuration allows setting topicRate to zero after registrationFixed
The report gives no description here.
InfoHardcoded magic numbers used throughout the codebaseFixed
The report gives no description here.
Show 10 more
InfoImplementation contracts can be initialized by anyoneFixed
The report gives no description here.
InfoInconsistent msg.sender vs _msgSender() usage in CreditManager’s onlyAuthorized modifierFixed
The report gives no description here.
InfoInconsistent validation for protocolFee between initialize(...) and _- setProtocolFee(...)Fixed
The report gives no description here.
InfoisRedeemOrderValid returns false for cancelled markets despite executeRedeem succeedingFixed
The report gives no description here.
InfoMarket hard-codes a 6-decimal token assumption via DECIMAL_MULTIPLIERFixed
The report gives no description here.
InfoMarketFactory owner storage variable has no setter preventing rotation for market ownershipFixed
The report gives no description here.
InfoMAX_SHARES overflow guard is not compatible with the allowed liquidityParameter rangeFixed
The report gives no description here.
InfominimumOrderAmount stored but never enforcedFixed
The report gives no description here.
InfoNo combined ceiling on protocolFee + curatorFeeFixed
The report gives no description here.
Best PracticesNo mechanism to deauthorize markets from CreditManagerFixed
The report gives no description here.
Show 9 more
InfoNo on-chain order cancellation for regular ordersFixed
The report gives no description here.
InfoNon-delayed operations invalidate pending delayed operations via shared nonceFixed
The report gives no description here.
Best PracticesNon-standard double-hash EIP-712Fixed
The report gives no description here.
Best PracticesOrderbookFactory allows 100% protocol fee at market creationFixed
The report gives no description here.
InfoOrderbookMarket emergency withdrawal has no timelockFixed
The report gives no description here.
Best PracticesOrderbookMarket transferFrom silently no-ops for invalid token IDsFixed
The report gives no description here.
Best PracticesState changes in the predict(...) function are ineffective due to an immediate revertFixed
The report gives no description here.
InfoWinnerSet event is misleading when a draw is declaredFixed
The report gives no description here.
Best PracticesWrong error emitted in withdrawCuratorFeesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Palpitada’s security record
PalpitadaSecurity firm
Nethermind Security57 projects reviewed · 81 reports · latest Sep 2026
See Nethermind Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us