# Empty orders do not request from oracle and during settlement they use an invalid oracle version with `price=0` which messes up a lot of fees and funding accounting leading to loss of funds for the makers

Empty orders skip oracle request, settling with invalid price=0, zeroing fees/funding for makers in Perennial V2.

- Payout: Contest reward
- Severity: high
- Program: Perennial V2 3
- Credited: panprog
- Disclosed: 2024-02-28
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-02-perennial-v2-3-judging/issues/5
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Market contract settlement logic
**Root cause:** Empty orders do not request an oracle version, so settlement uses an invalid version with price=0, which is multiplied into fee and funding accumulations.
**Steps:**
1. Call `market.update` with an order that does not change position (empty order).
2. Observe that `oracle.request` is skipped because `newOrder.isEmpty()` is true.
3. When a later valid oracle version is committed, `_processOrderGlobal` calls `oracle.at(newOrder.timestamp)` which returns an invalid version with `price=0`.
4. The invalid version is used in `VersionLib.accumulate`, multiplying fees and funding by zero.
5. Run the provided test to see zero fee accumulation between versions 300 and 400.
**How found:** Code review of `Market._update` and `_processOrderGlobal` revealed that empty orders skip oracle requests, and the invalid oracle version's price=0 is still used in accumulation.
**Exploitation:** Any user can trigger empty orders via normal `market.update` calls (e.g., settlement callbacks), causing fees and funding to be zero for the period until the next non-empty order, systematically reducing maker revenue.
**Insight:** Check whether oracle requests are conditionally skipped for no-op operations; if so, verify that settlement handles missing oracle versions without using default zero values in financial calculations.