Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>GTE -- Perp>Informational findings>Inaccessible market-setting functions via delegate call
GeneralOverview
Findings
Critical (1)
High (4)
Medium (4)
Low (3)
Informational (6)Lack of explicit asset validationUnsafe cast from int256 to uint256Inaccessible market-setting functions via delegate callCentralization risk — owner-controlled deposits to insurance fund using user allowancesInconsistency between processWithdraws and previewWithdrawLack of documentation
DiscussionLimited test suiteThe setIndexPrice() update frequency
Threat ModelWhat are threat models?CollateralManager.solGTL.solPerpCLOB.solPerpManager.solPosition.sol
Audit ResultsAssessment Results
Category: Coding Mistakes

Inaccessible market-setting functions via delegate call

Informational Severity
Informational Impact
N/A Likelihood

Description

The setMaxLimitsPerTx, setMaxLimitsExempt, and setMinLimitOrderAmountInBase functions in PerpCLOB are designed to be called via the delegate call to modify the PerpBook's MarketSettings.

However, the PerpCLOBCaller contract does not implement wrapper functions to delegate these calls, making them inaccessible.

Additionally, the reduce function, which is also intended to be executed via delegate call, is missing from the PerpCLOBCaller implementation.

Impact

As a result, market settings cannot be updated.

Recommendations

Implement the missing delegate-call forwarding functions in PerpCLOBCaller for setMaxLimitsPerTx, setMaxLimitsExempt, and setMinLimitOrderAmountInBase.

Additionally, consider implementing support for the reduce function if it is intended to be used.

Remediation

Zellic © 2025Back to top ↑