# dispatchFrom() liveness DoS via StaleOracle: spot price manipulation blocks liquidations, force exercises, and premium settlements

PanopticPool.dispatchFrom() reverts with StaleOracle whenever spot tick deviates >513 ticks from TWAP, blocking liquidations, force exercises, and premium settlements.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: fuzious
- Disclosed: 2026-03-09
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:dos vuln:liquidation vuln:oracle-manipulation

**Target:** PanopticPool.dispatchFrom() liquidation/settlement entrypoint
**Root cause:** dispatchFrom() unconditionally checks abs(currentTick - twapTick) > tickDeltaLiquidation (default 513 ticks ≈5.27%) and reverts with StaleOracle before determining operation type, so all liquidation, force-exercise, and premium-settlement paths share the same liveness gate.
**Steps:**
1. Identify insolvent position and submit liquidation via `dispatchFrom()`; observe success while `abs(currentTick - twapTick) <= 513`.
2. Front-run the liquidation tx with a swap pushing the pool tick beyond ±513 ticks from twapTick.
3. Liquidation tx executes and reverts with `Errors.StaleOracle()`.
4. Optionally back-run to restore price and minimize exposure; repeat to delay liquidation indefinitely.
5. Same gate blocks force exercise (`solvent == numberOfTicks && toLength == finalLength + 1`) and premium settlement (`toLength == finalLength`).
**How found:** Code reading of dispatchFrom() revealed the StaleOracle check executes before operation-type branching, making it a shared precondition; noted default 513-tick threshold in RiskEngine.sol and reasoned that a swap can exceed it, then built Foundry PoCs comparing in-range vs out-of-range behavior for all three operation types.
**Exploitation:** Attacker (insolvent owner or MEV searcher) watches public mempool for liquidation tx, front-runs with a swap moving spot tick past the 513-tick TWAP delta threshold, causing dispatchFrom to revert with StaleOracle; back-runs to restore price, repeatedly preventing liquidation of an insolvent position.
**Escalation:** Repeated front-run/back-run cycles extend insolvency indefinitely, increasing bad-debt/socialized-loss risk to PLPs; also griefs liquidators with repeated gas-wasting reverts.
**Insight:** When a shared entrypoint gates multiple operation types behind one oracle-deviation check, test whether an attacker-controllable spot price can trip that gate to block time-sensitive operations (liquidations) — a liveness DoS distinct from the price-manipulation the gate was meant to stop.