# Premia calculation can cause DOS

Panoptic SFPM premia calc casts to uint128; dust netLiquidity with non-zero fees overflows, reverting mints/burns (self-DoS).

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: hash
- Disclosed: 2024-06-24
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-panoptic-findings/issues/520
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-panoptic%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:precision-loss

**Target:** SemiFungiblePositionManager premia calculation (_getPremiaDeltas)
**Root cause:** premium0X64_base = mulDiv(collected0, totalLiquidity * 2**64, netLiquidity**2).toUint128() overflows when netLiquidity is dust and removedLiquidity is large, since totalLiquidity/netLiquidity^2 becomes huge.
**Steps:**
1. Open short of 100_000_000e18 PEPE in PEPE/WETH 0.3% pool (liquidity > 2**71).
2. Mint long of posSize/2 twice so netLiquidity is dust and removedLiquidity large.
3. Swap to accrue fees in the range so amountToCollect != 0.
4. Call `sfpm.mintTokenizedPosition(shortTokenId, posSize, ...)`; reverts with `Errors.CastingError` in `_getPremiaDeltas`.
5. Dust variant: mint 219738690 amount0 over ticks 199260-199290, remove in two halves; liquidityRemoval1+2 = liquidityMinted-1, leaving dust=1.
**How found:** Code reading of _collectAndWritePositionData -> _updateStoredPremia -> _getPremiaDeltas; noticed toUint128 cast and reasoned that low netLiquidity with high removedLiquidity makes mulDiv result exceed uint128. Verified with forge PoC on PEPE/WETH fork.
**Exploitation:** Attacker (or normal partial burns) leaves dust netLiquidity; once fees accrue, any mint/burn on that position reverts, bricking the position. Attacker can also transfer such a position to a victim to DoS their mints.
**Escalation:** Position can be transferred to another address, extending DoS to that address.
**Insight:** In AMM/CLMM accounting, look for fixed-width casts (toUint128) on ratios whose denominator can be rounded to dust by partial withdrawals; test mint/withdraw in halves to force rounding dust, then trigger fee accrual to hit the overflow path.