Perennial V2 Update 2 audit
Audit competition · firm’s term: security review
Sherlock reviewed Perennial (Perennial V2 Update 2 audit) on 6 Apr 2024: 13 findings, 0 critical; 12 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings13
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 1 | 9 |
| Low | 0 | 0 | 0 |
HighEmpty orders do not request from oracle and during settlement they use an invalid oracle version with price=0 which messes up a lot of fees and funding accounting leading to loss of funds for the makeFixed
The report gives no description here.
HighRequested oracle versions, which have expired, must return this oracle version as invalid, but they return it as a normal version with previous version's price insteadFixed
The report gives no description here.
HighVault global shares and assets change will mismatch local shares and assets change during settlement due to incorrect _withoutSettlementFeeGlobal formulaFixed
The report gives no description here.
Medium_loadContext() uses the wrong pendingGlobal.Fixed
The report gives no description here.
MediumAll transactions to claim assets from the vault will revert in some situations due to double subtraction of the claimed assets in market position allocations calculation.Fixed
The report gives no description here.
MediumChainlinkFactory will pay non-requested versions keeper feesFixed
The report gives no description here.
MediumIf referral or liquidator is the same address as the account, then liquidation/referral fees will be lost due to local storage being overwritten after the claimable amount is credited to liquidator orFixed
The report gives no description here.
MediumLiquidator can set up referrals for other usersFixed
The report gives no description here.
MediumMakers can lose funds from price movement even when no long and short positions are opened, due to incorrect distribution of adiabatic fees exposure between makersFixed
The report gives no description here.
MediumOrders on Optimism chains can not be settled due to revert of keep()Fixed
The report gives no description here.
Show 2 more
MediumVault and oracle keepers DoS in some situations due to market.update(account,max,max,max,0,false)Fixed
The report gives no description here.
MediumVault checkpoints slightly incorrect conversion from assets to shares leads to slow loss of funds for long-time vault depositorsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Perennial’s security record
PerennialSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us