Submission Details
Severity:
Market ID Delegation Vulnerabilities
Summary
ZLP vaults delegate liquidity to invalid markets due to missing validation.
Vulnerability Details
MarketMakingEngine.addMarketToVault() accepts arbitrary marketId inputs without verifying they correspond to valid PerpsEngine markets.
Impact
LPs’ funds could be permanently stuck in non-existent markets.
Tools Used
Manual review of CreditDelegationBranch.sol
Recommendations
Add a whitelist of valid marketId values and cross-check with the PerpsEngine
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.