highLogic errorEVM-Solidity
Perennial V2 Update #3: Market coordinator can set `staleAfter` to a huge value allowing anyone to steal all market collateral when there are no transactions for some time
- Payout
- $0
- Protocol
- Perennial V2 Update #3
- Disclosed
- Sep 13, 2024
- Source
- sherlock
Perennial V2's RiskParameter contract permits setting the `staleAfter` oracle-staleness bound with no validation. A malicious market coordinator — who the README explicitly grants broad parameter control — can set `staleAfter` to uint24.max and floor margin/ma …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.