012.md

Shambolic Mint Dinosaur

High

The update functions lack a deadline parameter.

Summary

In the Market.sol contract the update functions lack a deadline parameter. Attackers can exploit pending transactions during high volatility by executing them at unfavorable times.

Root Cause

In https://github.com/sherlock-audit/2025-01-perennial-v2-4-update/blob/main/perennial-v2/packages/core/contracts/Market.sol#L147 https://github.com/sherlock-audit/2025-01-perennial-v2-4-update/blob/main/perennial-v2/packages/core/contracts/Market.sol#L176 https://github.com/sherlock-audit/2025-01-perennial-v2-4-update/blob/main/perennial-v2/packages/core/contracts/Market.sol#L213 https://github.com/sherlock-audit/2025-01-perennial-v2-4-update/blob/main/perennial-v2/packages/core/contracts/Market.sol#L223 https://github.com/sherlock-audit/2025-01-perennial-v2-4-update/blob/main/perennial-v2/packages/core/contracts/Market.sol#L232 https://github.com/sherlock-audit/2025-01-perennial-v2-4-update/blob/main/perennial-v2/packages/core/contracts/Market.sol#L247 https://github.com/sherlock-audit/2025-01-perennial-v2-4-update/blob/main/perennial-v2/packages/core/contracts/Market.sol#L264 https://github.com/sherlock-audit/2025-01-perennial-v2-4-update/blob/main/perennial-v2/packages/core/contracts/Market.sol#L283

the update functions lack a deadline parameter. Attackers can exploit pending transactions during high volatility by executing them at unfavorable times.

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

No response

Impact

Transactions can be front-run or delayed, leading to sandwich attacks.

PoC

No response

Mitigation

Add a deadline parameter to all user-initiated functions and validate block.timestamp <= deadline.