Perennial V2 Update #3 — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Perennial V2 Update #3, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Perennial V2 Update #3 reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Perennial V2 Update #3
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Perennial V2 Update #3: `MultiInvoker` and `Manager` orders execution can be DOS in key moments if AAVE/Compound utilization is at 100%
Perennial V2's MultiInvoker and Manager order execution paths charge an interface fee that, when the unwrap flag is set, converts the protocol's DSU token back to USDC through a reserve contract. That reserve stores part of its collateral in AAVE and Compound, and withdrawals from those lending pools revert whenever the pool is at ~100% utilization (supply roughly equals debt). Since both AAVE and Compound constrains withdrawable amount to the supply-minus-debt difference, an attacker can transiently force 100% utilization by taking out USDC debt, blocking stop-loss/take-profit and withdrawal orders at precisely the moment their execution price is reached. This delays price-sensitive orders until the market moves, causing users to be filled at worse prices, be liquidated, or have orders lapsed entirely — a griefing DOS (confirmed as medium severity, fixed by maintainers).
Perennial V2 Update #3: The `Market.migrate()` function has no effect and does not migrate `PositionStorageGlobal` to the new storage layout, breaking the migration assumption.
During the Perennial V2 2.2-to-2.3 migration, the protocol set out to consolidate global and local position storage from a 2-slot to a 1-slot layout. The `Market.migrate()` function is meant to read the old deprecated `maker` value from slot 1 and fold it into the new slot-0 layout on a market-by-market basis. However, the `read()` and `store()` accessor functions in `PositionStorageGlobalLib` were never updated, so `migrate()` reads and writes using the old layout, leaving slot 1's deprecated `maker` untouched. The finding was validated by the protocol team and fixed via PR #442, which corrects the bit-shifting in the accessors and clears the deprecated slot during migration. While the bug does not break current functionality, it defeats the migration assumption and risks breaking the protocol in future versions.