Perpetual audit

Sherlock18 Mar 2024Code version: not recorded (see the report)

Audit competition · firm’s term: security review

Sherlock reviewed Perp Labs (Perpetual audit) on 18 Mar 2024: 14 findings, 0 critical; 3 marked fixed, 11 acknowledged.

No open critical findings

Open the report Open Perp Labs’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	2	0
Medium	0	9	3
Low	0	0	0

HighFunding Fee Rate is calculated based only on the Oracle Maker's skew but applied across the entire market, which enables an attacker to generate an extreme funding rate for a low cost and leverage thaAcknowledged

The report gives no description here.

HighTwo Pyth prices can be used in the same transaction to attack the LP poolsAcknowledged

The report gives no description here.

MediumAttackers can create positions that have no incentive to be liquidatedAcknowledged

The report gives no description here.

MediumBorrow fees can be arbitrarily increased without the maker providing any valueAcknowledged

The report gives no description here.

MediumIncorrect premium calculation in OracleMakerAcknowledged

The report gives no description here.

MediumLoss of funds for trader because whitelisted maker can't be liquidatedAcknowledged

The report gives no description here.

MediumNo slippage control on maker LP deposit()/withdraw()Acknowledged

The report gives no description here.

MediumOracleMaker's price with spread does not take into account the new positionAcknowledged

The report gives no description here.

MediumSpotHedgeBaseMaker LPs will be able to extract value during a USDT/USDC de-pegAcknowledged

The report gives no description here.

MediumThere may be excess funds in the PnL pool or bad debt due to the funding fee.Acknowledged

The report gives no description here.

Show 1 more

MediumWithdrawal caps can be bypassed by opening positions against the SpotHedgeBaseMakerAcknowledged

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Perp Labs’s security record

Perp Labs

Audits1 audit by 1 firmLast audit Mar 2024, by Sherlock.

Critical findingsNo open critical findingsIn 1 report.

Open Perp Labs’s security record

Security firm

Sherlock

46 projects reviewed · 67 reports · latest Sep 2026

See Sherlock’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.