Perpetual Protocol loses $3,062 in Optimism OrderBook exploit
Security & Exploits ·
An attacker drained a small but exploitable sum from Perpetual Protocol by calling an unprotected funding function on the OrderBook contract deployed on Optimism.
The exploit targeted updateFundingGrowthAndLiquidityCoefficientInFundingPayment(), a function within the OrderBook contract that lacked access controls. Without a guard restricting who could call it, the attacker was able to invoke the function directly and manipulate funding growth and liquidity coefficient values used in funding payment calculations.
By altering those values, the attacker inflated their realized profit-and-loss figure within the protocol's accounting logic. That inflated PnL was then used to extract funds, with the attacker walking away with roughly $3,062 in USDC, according to a report shared on X.
The mechanism sits within a broader category tracked as funding exploits, where manipulation of funding-rate or funding-growth parameters in perpetual-futures protocols can be leveraged to misstate a trader's position value. In this case, the absence of a permission check on the OrderBook function meant the funding calculation could be triggered and skewed by an external caller rather than only by authorized protocol logic.
The loss is corroborated across coverage of the incident, with two distinct sources describing the same root cause: an unguarded OrderBook funding function on Optimism that let the attacker inflate realized PnL before draining USDC from the protocol.
What remains unclear is whether Perpetual Protocol has patched the missing access control on the affected function, whether any funds have been recovered or the attacker identified, and whether other contracts sharing similar funding-calculation logic face the same exposure. No statement from the protocol addressing remediation has been included in the available reporting.