# The poolExposure for token1 is erroneously calculated as shortPremium - longPremium;

PanopticVaultAccountant.computeNAV subtracts shortPremium from longPremium for token1, inverting asset/liability signs and mispricing vault shares on deposit/withdraw.

- Payout: Contest reward
- Severity: high
- Program: Panoptic
- Credited: AlexCzm
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-06-panoptic-hypovault#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PanopticVaultAccountant.computeNAV (ERC4626 vault accounting)
**Root cause:** poolExposure1 computes longPremium.leftSlot() - shortPremium.leftSlot(), reversing the asset (shortPremium) and liability (longPremium) signs used correctly for token0.
**Steps:**
1. Deploy vault with one pool where token0 is underlying and token1 requires conversion.
2. Mock premiums: shortPremiumLeft=150e18, shortPremiumRight=200e18, longPremiumLeft=50e18, longPremiumRight=50e18.
3. Set vault underlying balance 1000e18, no token1/collateral balances, zero legs.
4. Call `accountant.computeNAV(vault, underlyingToken, managerInput)`.
5. Observe NAV ~1048.99e18 instead of expected ~1250e18 (delta ~201e18) because token1 exposure is computed as 50-150=-100 instead of +100.
**How found:** Code review of computeNAV comparing the token0 and token1 exposure formulas; noticed the operands were swapped only for the left slot, then wrote a PoC with asymmetric premiums to expose the sign error hidden by the existing test's 50% tolerance.
**Exploitation:** Incorrect NAV feeds sharesReceived on deposit fulfillment and assetsReceived on withdrawal fulfillment, letting depositors/withdrawers receive more shares or assets than entitled, diluting other vault participants.
**Insight:** When two parallel formulas exist for token0/token1, diff their operand order; existing tests with loose relative tolerances (e.g. 50% of NAV) can mask sign inversions—tighten tolerance and use asymmetric premium values to surface them.