For more information about Plether, please visit https://plether.com and https://docs.plether.com.

Operational context

Plether Perps has been exercised in a public testnet environment. During the September 13–25, 2026 trading competition, v1.2.3 on Arbitrum Sepolia recorded:

• 16,852 executions
• 11,716 unique trading accounts
• 52,524 on-chain transactions involving the perps contracts
• 435,283 contract events

These totals include all users, not only registered competitors. Researchers can use the release’s contract addresses and public transaction history to examine actual execution patterns and protocol behavior. This activity used mock collateral and an earlier protocol version.

https://github.com/Plether-Fi/plether-core/releases/tag/v1.2.3

Scope notes

CfdEngineLens and CfdEngineProtocolLens are in scope even though their names contain “Lens”, because the router and the pool use them on execution paths. The six view contracts listed under Out of Scope are excluded. Code in packages/shared, spot, options, perps-aa and perps-aa-client is out of scope.

Deployment and upgradeability

Plether Perps is a new system and is not deployed on mainnet. Earlier versions run on Arbitrum Sepolia. Release v2.0.0 (October 28, 2026) deploys the code in scope to Arbitrum Sepolia for testing. Perps contracts are not upgradeable.

Token standards

USDG (6 decimals) is the only collateral. LP shares are ERC-20 tokens issued by ERC-4626 vaults that implement ERC-7540 and ERC-7575 asynchronous requests.

Unusual points

See Operating Assumptions and Downgrade Criteria (Scope tab) and packages/perps/SECURITY.md, in particular market hours (frozen markets on weekends and holidays), binding orders in one global queue, and trader claims.

Educational resources

https://docs.plether.com. In packages/perps: README.md, SECURITY.md, INTERNAL_ARCHITECTURE_MAP.md, WHITEPAPER.md and ACCOUNTING_SPEC.md. Technical walkthrough: https://www.youtube.com/watch?v=bdXfmfQADdA.

Program Assurances

Asset Accuracy Assurance

Bugs found on assets incorrectly listed in-scope are valid.

Code Update Assurance

Duplicate submissions of bugs are valid until the relevant bug fix is public. Once a fix is public, the bug is out of scope and later submissions of it are invalid. Duplicate submissions of Insights are invalid.

The project commits to keeping all information about bug findings private until the competition results are published. This includes bug findings found independently by the project or from concurrent private audits.

Code Freeze Assurance

Code of the assets in scope is frozen at commit a82d4fefb02768e5b3bddcc97dee371eee24fea8 while the program is live.

Standardized Rules

This program follows Immunefi's standard competition rules. For the full default rules on validity, duplicates, known issues, severity, disputes, KYC, payments, and publication, read How Audit Competitions Work: Rules and Policies. Where this program page defines a specific rule, the program page prevails.

The rules on this page do not change after launch. If a clarification is needed, it applies to every report already received.

Insight Reporting

Insight reports may be submitted to this program. Runnable code is not required, but the PoC section must describe the conditions under which the insight is valuable.

Only the best report of a given Insight is rewarded. Duplicates of Insights are not rewarded. Insights are rewarded according to Immunefi's Standardized Competition Reward Terms (link: https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873) and are not eligible for mediation or appeal.

Dispute Resolution

Disputes may only address report validity, duplicate determinations, and severity.

If a researcher disagrees with a closure decision while the competition is live, they may request mediation. A mediation fee, set by Immunefi, is required to initiate the review.

After the evaluation phase, a dispute period opens for appealing decisions. Immunefi announces a final 48-hour deadline for the last disputes. Once the window closes, results are final.

Immunefi has final say on validity, duplicates, and severity, based on the terms of this program. Insights are not eligible for mediation or appeal.

Responsible Publication Policy

Immunefi will publish bug reports, earnings, and a leaderboard for this Audit Competition.

Security Researchers may publish their bug reports as well, but only after Immunefi has published the valid bug reports as part of the competition results.

Eligibility Criteria

Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:

• On OFACs SDN list
• Official contributor, both past or present
• Employees and/or individuals closely associated with the project
• Security auditors that directly or indirectly participated in an audit review of the code in scope (Such auditors may still participate in this program only if they receive project permission)
• From a restricted country or territory per Immunefi's Terms of Use (link: https://immunefi.com/terms-of-use/)
• Under 18 years of age. Participants under 18 cannot pass KYC and will not receive rewards.

Submission Fees

A submission fee, set and managed by Immunefi, applies to each report and is shown at submission time. If a researcher disagrees with a closure decision, initiating a mediation also requires a fee set by Immunefi.