# Liquidations can be permanently blocked via getLiquidationBonus() unsigned underflow (Insolvent-but-unliquidatable accounts)

Unsigned subtraction in RiskEngine.getLiquidationBonus() underflows when cross-balance exceeds threshold, reverting liquidations of distribution-insolvent Panoptic accounts.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: edoscoba
- Disclosed: 2026-03-09
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** RiskEngine.getLiquidationBonus / PanopticPool liquidation path
**Root cause:** getLiquidationBonus computes `thresholdCross - balanceCross` in uint256 assuming required >= collateral, but distribution insolvency with cross-margining disabled by crossBufferRatio can make balanceCross > thresholdCross, underflowing and reverting the whole liquidation.
**Steps:**
1. Identify account where isAccountSolvent() returns false due to per-token distribution insolvency (token1 below requirement, token0 surplus) with high utilization disabling cross-margining.
2. Call PanopticPool.dispatchFrom() which routes to liquidation at all liquidation ticks.
3. Liquidation reaches RiskEngine.getLiquidationBonus() computing `Math.min(balanceCross/2, thresholdCross - balanceCross)`.
4. balanceCross > thresholdCross causes uint256 underflow revert, bubbling up and reverting liquidation.
5. Run PoC: `forge test --match-path test/foundry/core/LiquidationBonusUnderflowPoC.t.sol -vvv`.
**How found:** Code review of liquidation path: noticed getLiquidationBonus assumes required >= collateral while isAccountSolvent uses a different crossBufferRatio-based solvency semantics, creating a mismatch exploitable under distribution insolvency.
**Escalation:** Undercollateralized positions remain open, increasing PLP loss risk and blocking recovery mechanisms dependent on liquidation.
**Insight:** When a protocol has two solvency/bonus computations using different collateral semantics (per-token vs cross-total), check whether the bonus path's arithmetic assumptions hold in every state the solvency check can produce — mismatched invariants yield DoS reverts.