Perennial security record
As of 10 Nov 2026, Perennial has 1 audit report on Trustblock, by Sherlock, dated 31 Jan 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits0· Audit competitions 3
Newest first
| Report | Security firm | Date | Scope | Critical findings | Source |
|---|---|---|---|---|---|
| Perennial V2 Update 4 auditAudit competition | Security firm: Sherlock | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Perennial V2 Update 3 auditAudit competition | Security firm: Sherlock | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
| Perennial V2 Update 2 auditAudit competition | Security firm: Sherlock | Date: | Scope: Not recorded; see the report | None open | GitHub ↗ |
Findings41
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 12 |
| Medium | 0 | 2 | 25 |
| Low | 0 | 0 | 0 |
HighAnyone can steal all funds from the market due to incorrect health accounting for pending pnl from difference of intent price and market price when multiple intents are used.Perennial V2 Update 4 audit · Sherlock · 31 Jan 2025Fixed
The report gives no description here.
Open the reportHighIntent orders are guaranteed to execute, but fees from these orders are not accounted in collateral, allowing user to withdraw all collateral ignoring these pending fees.Perennial V2 Update 4 audit · Sherlock · 31 Jan 2025Fixed
The report gives no description here.
Open the reportHighInvariantLib uses current position for margin check allowing to withdraw collateral while the position decrease is only pending and can cause unexpected immediate user liquidation.Perennial V2 Update 4 audit · Sherlock · 31 Jan 2025Fixed
The report gives no description here.
Open the reportHighWhen account is liquidated (protected), liquidator can increase account's position to any value up to 2**62 - 1 breaking all market accounting and stealing all market funds.Perennial V2 Update 4 audit · Sherlock · 31 Jan 2025Fixed
The report gives no description here.
Open the reportHighLack of access control in the MarketFactory.updateExtension() function.Perennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportHighMaliciously specifying a very large intent.price will result in a large gain at settlement, stealing fundsPerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportHighMarket coordinator can liquidate all users in the marketPerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportHighMarket coordinator can set staleAfter to a huge value allowing anyone to steal all market collateral when there are no transactions for some timePerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportHighPerennial account users with rebalance group may suffer a donation attackPerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportHighEmpty orders do not request from oracle and during settlement they use an invalid oracle version with price=0 which messes up a lot of fees and funding accounting leading to loss of funds for the makePerennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportShow 10 more
HighRequested oracle versions, which have expired, must return this oracle version as invalid, but they return it as a normal version with previous version's price insteadPerennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportHighVault global shares and assets change will mismatch local shares and assets change during settlement due to incorrect _withoutSettlementFeeGlobal formulaPerennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumLiquidations are temporarily blocked if user's pending position close amount is greater than the latest position size.Perennial V2 Update 4 audit · Sherlock · 31 Jan 2025Fixed
The report gives no description here.
Open the reportMediumSome accounts using Intents to trade might be liquidated while healthy or be unliquidatable while being unhealthy.Perennial V2 Update 4 audit · Sherlock · 31 Jan 2025Fixed
The report gives no description here.
Open the reportMediumVault.settle(account=coordinator) will lose profitSharesPerennial V2 Update 4 audit · Sherlock · 31 Jan 2025Fixed
The report gives no description here.
Open the reportMedium_ineligible() redemptionEligible is miscalculatedPerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumAnyone can cancel other accounts nonces and groups, leading to griefing their Intents.Perennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumController's core function of Rebalance will not rebalance when rebalance is needed in some cases, breaking core functionalityPerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumCorrupted storage after upgrade in the MarketFactory contract.Perennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumKeepers can lose compensation feePerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportShow 10 more
MediumMarket coordinator can set proportional and adiabatic fees much higher than limited by protocol due to fixed point truncationPerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumMultiInvoker and Manager orders execution can be DOS in key moments if AAVE/Compound utilization is at 100%Perennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumMultiInvoker, Manager and Account unexpected reverts in certain conditions due to AAVE reverting on deposits and withdrawals with 0 amountPerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumsettle() asyncFee is left in the KeepFactory and is not transfer to the keeper.Perennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumThe Market.migrate() function has no effect and does not migrate PositionStorageGlobal to the new storage layout, breaking the migration assumption.Perennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumThe RiskParameter.liquidationFee variable is not treated and validated as a percentage value, leading to breaking protocol invariants.Perennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumTriggerOrder.notionalValue() Using the wrong latestPositionLocal to calculate the value causes the user to overpay feesPerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMediumwhen ReserveBase undercollateralized , Manager.orders will not be able to executePerennial V2 Update 3 audit · Sherlock · 13 Sep 2024Fixed
The report gives no description here.
Open the reportMedium_loadContext() uses the wrong pendingGlobal.Perennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumAll transactions to claim assets from the vault will revert in some situations due to double subtraction of the claimed assets in market position allocations calculation.Perennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportShow 7 more
MediumChainlinkFactory will pay non-requested versions keeper feesPerennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumIf referral or liquidator is the same address as the account, then liquidation/referral fees will be lost due to local storage being overwritten after the claimable amount is credited to liquidator orPerennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumLiquidator can set up referrals for other usersPerennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumMakers can lose funds from price movement even when no long and short positions are opened, due to incorrect distribution of adiabatic fees exposure between makersPerennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumOrders on Optimism chains can not be settled due to revert of keep()Perennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumVault and oracle keepers DoS in some situations due to market.update(account,max,max,max,0,false)Perennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumVault checkpoints slightly incorrect conversion from assets to shares leads to slow loss of funds for long-time vault depositorsPerennial V2 Update 2 audit · Sherlock · 6 Apr 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="perennial"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us