Plether lets users trade and hedge the strength of the US dollar onchain. Plether Perps is a perpetual market on a dollar index built from a basket of six major currencies: EUR, JPY, GBP, CAD, SEK and CHF. Traders open LONG USD positions, which gain when the dollar strengthens against the basket, or SHORT USD positions, which gain when it weakens. Margin and settlement are in USDG, and orders are priced by Pyth through a delayed-order model.
Liquidity providers deposit USDG into a shared pool that takes the other side of trader positions. The pool has two tranches: a Senior tranche, which earns a targeted coupon and absorbs losses last, and a Junior tranche, which absorbs losses first and receives the remaining upside.
Live
Triaged by Immunefi
Runnable PoC Required
Vault program
Codebase
Documentation
Build Commands, Test Commands, and How to Run Them
Requirements: Foundry (Forge 1.5.1). Contracts use Solidity 0.8.35, compiled with via-IR.
git clone --recurse-submodules https://github.com/immunefi-team/audit-comp-plether.git
cd audit-comp-plether
# Check out the exact commit and its pinned submodules
git checkout --detach a82d4fefb02768e5b3bddcc97dee371eee24fea8
git submodule update --init --recursive
# Build perps; downloads Solidity 0.8.35 if needed
make build-perps
# Run the perps quick test suite
make test-perps
Without make: forge build --root packages/perps and forge test --root packages/perps.
make test-perps runs the quick test suite.
Fork testing. Release v2.0.0 deploys the in-scope perps contracts to Arbitrum Sepolia, to make fork testing with Anvil easier. The release was built from commit 1209ca8a5b94a4fb6323c7c4585846ed93db3932, and packages/perps/src is identical at the commit in scope, so the deployed contracts match the code in scope. Contract addresses and the deployment manifest are in https://github.com/immunefi-team/audit-comp-plether/tree/a82d4fefb02768e5b3bddcc97dee371eee24fea8/deployments/releases/2026-10-28-perps-arbitrum-sepolia-v2.0.0 and in the release: https://github.com/Plether-Fi/plether-core/releases/tag/v2.0.0
This deployment is for testing only. Its configuration (a single owner address, test liquidity, mock USDG) is not the production configuration, and severity is assessed with the parameters stated on this page. Run tests on a local fork; do not send transactions to the deployed contracts.