# Market: DoS when stuffed with pending protected positions

Perennial Market skips pending-queue limit checks for protected (liquidation) updates, letting the pending queue grow until settlement loops OOG-revert, bricking the market.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: n33k
- Disclosed: 2023-07-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-perennial-judging/issues/94
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-5
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Market.sol pending position update queue / _settle loop
**Root cause:** _invariant returns early for protected position updates, bypassing maxPendingGlobal/maxPendingLocal checks, so liquidation updates accumulate unbounded in _pendingPosition. _settle then loops over all of them and reverts OOG.
**Steps:**
1. Observe `_invariant` returns early when `protected == true`, skipping the maxPendingGlobal/maxPendingLocal check.
2. Each liquidation at a new granularity timestamp stores a new `_pendingPosition[currentId]` entry.
3. With no oracle commits for many granularity windows, pending entries accumulate past the intended limit.
4. On next `update`, `_settle` loops over all pending positions and reverts OOG, blocking all updates.
**How found:** Code reading of _invariant's early return for protected updates and tracing how _pendingPosition entries are stored and later settled in a while loop in _settle.
**Exploitation:** No direct theft; state arises from prolonged missing oracle commits plus repeated liquidations across granularity windows, or an attacker forcing many protected updates at low cost. Settlement loop exceeds gas, bricking update() and locking funds.
**Insight:** When a validation function has an early-return branch for a privileged path (liquidations), check whether the skipped invariant also guards a data structure that is later iterated unboundedly — the guard may be load-bearing for gas, not just accounting.