# NAV calculation inconsistency due to underlying token position in pool configuration

computeNAV in PanopticVaultAccountant applies Math.max per-pool before adding underlying balance, so vaults with underlying token in pool config report inconsistent NAV.

- Payout: Contest reward
- Severity: high
- Program: Panoptic
- Credited: dhank
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-06-panoptic-hypovault#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-06-panoptic-hypovault%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PanopticVaultAccountant.sol computeNAV
**Root cause:** Underlying token balance is folded into poolExposure inside the loop (subject to per-pool Math.max(_,0)) when the underlying appears in a pool, but added after all per-pool clamping otherwise, so negative exposures offset differently.
**Steps:**
1. Identify computeNAV loop applying `nav += uint256(Math.max(poolExposure0 + poolExposure1, 0))` per pool.
2. Note underlying balance added post-loop only when `!skipUnderlying`.
3. Construct Vault A with USDC in ETH/USDC pool: poolExposure=-150+50=-100, max=0, skipUnderlying=true, NAV=0.
4. Construct Vault B with USDC not in ETH/WBTC pool: poolExposure=-150, max=0, then +50 underlying, NAV=50.
5. Observe economically identical vaults report different NAV, corrupting share price in fulfillDeposit/fulfillWithdrawals.
**How found:** Code review of computeNAV comparing the two branches: underlying included inside loop vs added after per-pool Math.max clamp, spotting the asymmetric clamping.
**Exploitation:** Manager calls fulfillDeposit()/fulfillWithdrawals() on a vault whose underlying token is absent from its pools; inflated NAV yields incorrect share pricing, letting depositors/withdrawers transact at wrong rates.
**Insight:** When aggregating signed exposures with a floor-at-zero clamp, check whether any component is added before vs after the clamp; per-item clamping silently discards offsetting positive balances that a single final clamp would preserve.