Perennial V2 Update 4 audit
Audit competition · firm’s term: public audit contest
Sherlock reviewed Perennial (Perennial V2 Update 4 audit) on 31 Jan 2025: 7 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings7
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 0 |
HighAnyone can steal all funds from the market due to incorrect health accounting for pending pnl from difference of intent price and market price when multiple intents are used.Fixed
The report gives no description here.
HighIntent orders are guaranteed to execute, but fees from these orders are not accounted in collateral, allowing user to withdraw all collateral ignoring these pending fees.Fixed
The report gives no description here.
HighInvariantLib uses current position for margin check allowing to withdraw collateral while the position decrease is only pending and can cause unexpected immediate user liquidation.Fixed
The report gives no description here.
HighWhen account is liquidated (protected), liquidator can increase account's position to any value up to 2**62 - 1 breaking all market accounting and stealing all market funds.Fixed
The report gives no description here.
MediumLiquidations are temporarily blocked if user's pending position close amount is greater than the latest position size.Fixed
The report gives no description here.
MediumSome accounts using Intents to trade might be liquidated while healthy or be unliquidatable while being unhealthy.Fixed
The report gives no description here.
MediumVault.settle(account=coordinator) will lose profitSharesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Perennial’s security record
PerennialSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us