Veranta V2 Review

Overview

Veranta, formerly Avantis, had its V2 perpetuals contracts reviewed by three audit firms, one after another. Zellic went first and Sherlock second.

Guardian went last, on code that already carried Sherlock's fixes. It reported 4 Critical and 18 High severity issues, more than the two earlier reports combined.

Every count on this page comes from the firm's own report, and all three reports are linked. Guardian's is in our portfolio.

Guardian

Guardian provides institutional-grade security for digital asset teams, onchain and off. Every engagement runs two independent teams, backed by Helix, Guardian's AI auditor, and only human-verified findings reach the client.

Veranta

Veranta is a perpetuals exchange on Base. Traders go long or short on crypto, forex, equities, indices and commodities against a USDC vault, using limit orders, TWAPs, RFQ fills, partial take-profits and stop-losses. Orders settle on signed oracle prices, including Pyth Lazer, with Chainlink feeds as a backup.

Three firms, one codebase

Veranta's audits page lists Guardian, Sherlock and Zellic for V2. Here is what each firm's report counts.

Firms grade and group issues differently: Sherlock combines Low and Info, and Zellic reviewed a diff rather than the whole codebase. The top of the scale is the clearest signal. Guardian reported 22 Criticals and Highs, Sherlock 10 and Zellic 5.

Each review built on the one before

1. Zellic, March 23 to April 10, 2026. A patch review of the changes from ddd748ce to 7eacd2cf. One Critical and four Highs.
2. Sherlock, June 1 to 28, 2026. A collaborative audit of 8b29281, 132 commits after Zellic's. Ten Highs, with fixes up to its final commit, 70f16f3.
3. Guardian, July 6 to September 11, 2026. Three rounds. The first reviewed d74b350, three commits after Sherlock's final commit: a storage refactor and event changes. Four Criticals and eighteen Highs.

What a third review found

Two of Guardian's four Criticals show what the earlier reviews left behind.

An oracle price inflated 100 million times

Veranta's Pyth Lazer parser never checked that a signed price update carried an exponent. A trader could request an update with only a price and a confidence value, and Pyth's signer would sign it.

Veranta then read the missing exponent as zero, pricing a normal feed 10⁸ times too high. The confidence check still passed.

Through updateMargin, which takes the trader's own price data, that price became fabricated funding collateral, withdrawable from the LP vault. Guardian's second team found the same flaw on its own, with a price-only update. The report lists both, as C-01 and C-03.

The parsing code is identical, line for line, at the commit Sherlock audited. Sherlock's report has no finding on it.

Fees erased by closing nothing

Sherlock's H-1 found that a partial close wiped the accrued borrow and funding fees on the rest of a position. Sherlock marked it resolved.

On the fixed code, Guardian showed the fees could still be erased (C-02). A partial close charged the whole position's fees against only the slice being closed, then reset the rest. In Guardian's reproduction, closing 0.100001 USDC wiped 63.42 USDC of borrow fees and 12.69 USDC of funding fees.

A signed partial take-profit or stop-loss with a coin size of zero did the same without closing any collateral. RFQ closes could too, once rounding took a slice to zero.

Other severe findings

• C-04. Rounding across repeated position increases poisoned a pair's open interest, opening a repeatable drain on LP funding.
• H-03. Position increases ignored unrealized losses, so a position at about 622x real leverage passed a 150x limit.
• H-06. LP withdrawals could shrink a pair's cap below its open interest, making closes and liquidations revert.
• H-01. A queued take-profit could settle at a newer, higher target that the oracle price never reached, overpaying the trader.

How Guardian approached it

• Two independent teams. Each team reviewed the full scope on its own, and their findings were merged and cross-checked. Both teams found the Lazer flaw.
• Contracts and backend together. Guardian's offchain teams reviewed the V2 backend at the same time. H-01 is one result: the take-profit race ran through the keeper service, which dropped the trigger price before execution.
• Proof, not suspicion. Each Critical came with a working proof of concept.
• Three rounds. A main review from July 6 to August 7, a remediation review of the fixes from August 17 to 28, and a second main review of the updated code from September 1 to 11. Each later round still found new Highs: one in remediation, three in the second main review.

Results

Guardian's report lists 199 findings across the three rounds, on about 9,000 lines of Solidity (nSLOC) in 27 contracts.

• Critical: 4
• High: 18
• Medium: 62
• Low: 66
• Informational: 49

All four Criticals are resolved, as are 14 of the 18 Highs. Veranta acknowledged the other four.

Impact

• Veranta's V2 contracts had a third review that found more severe issues than the first two combined
• Every Critical was fixed, including an oracle flaw that could drain the LP vault
• A fee bug marked resolved in an earlier audit was found still open, and closed
• One firm reviewed the contracts and the backend at the same time, so issues that crossed between them were caught

Already audited, and not sure it was enough? Guardian puts two independent teams on the same scope, and its reports are public, so you can read them before you choose.

Get a quote

Further reading

• Same Code, Different Results: Guardian vs. Other Auditors
• Avantis Offchain Review: the V2 backend
• Perp DEX Security: The Attack Surface of Perpetual Exchanges
• Perp DEX Audit Checklist: 40 Checks for Perpetual Exchanges