# `KeeperOracle.commit` will revert and won't work for all markets if any single `Market` is paused.

KeeperOracle.commit iterates all requesting markets and calls update; any single reverting market (paused or over maker limit) bricks commit for all markets sharing the oracle.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: panprog
- Disclosed: 2023-10-26
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-perennial-judging/issues/26
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-5
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** KeeperOracle.commit / Market.update settlement callback
**Root cause:** commit loops over all markets in the callback queue and calls _settle -> Market.update, which has whenNotPaused and other revert conditions; a single reverting market reverts the whole commit.
**Steps:**
1. Deploy one KeeperOracle shared by Market1 and Market2 (same factory).
2. Market1 and Market2 call KeeperOracle.request for a version, populating _globalCallbacks[timestamp].
3. Cause Market1.update to revert (pause factory, or push maker over makerLimit per issue #24).
4. Call KeeperOracle.commit(version); the loop hits Market1._settle -> update and reverts.
5. Market2 can no longer commit or trade; provider switch also blocked since latest oracle version can't be committed.
**How found:** Code reading of KeeperOracle.commit's callback loop and _settle, noticing Market.update carries whenNotPaused and other revert paths; reasoned that one reverting callback aborts the whole loop.
**Escalation:** A single market's revert condition (e.g. maker > makerLimit) escalates from bricking one market to bricking the shared oracle and every market using it, and blocks oracle provider switching.
**Insight:** When an oracle/settlement contract loops over multiple consumers calling back into them, any per-consumer revert (pause, limit, validation) becomes a global DoS; check callback loops for unguarded external calls and whether a single failure blocks shared state advancement.