# Liquidator can receive an inflated bonus against PLPs on PanopticPool._liquidate

CollateralTracker.settleBurn returns tokenPaid excluding burned commission shares, so PanopticPool._liquidate overstates netPaid and pays liquidators an inflated bonus.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: hecker_trieu_tien
- Disclosed: 2026-03-09
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#m-07
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:liquidation

**Target:** CollateralTracker.settleBurn / PanopticPool._liquidate
**Root cause:** settleBurn computes tokenPaid via _updateBalancesAndSettle before burning commission shares, so the returned value excludes commission paid by the liquidatee; _liquidate then uses this understated netPaid to size the liquidation bonus.
**Steps:**
1. Call `_liquidate` on an underwater account with non-zero realizedPremium so commission shares get burned in `settleBurn`.
2. Observe `settleBurn` returns `tokenPaid` from `_updateBalancesAndSettle` before `_burn(optionOwner, sharesToBurn)` for commission.
3. `_burnAllOptionsFrom` aggregates these `paidAmounts` into `netPaid` without commission.
4. `getLiquidationBonus(..., netPaid, shortPremium)` computes bonus from inflated remaining collateral, overpaying the liquidator.
**How found:** Code review of settleBurn return value ordering versus commission burn, tracing tokenPaid through _burnAllOptionsFrom into getLiquidationBonus.
**Exploitation:** Liquidator triggers liquidation of a position where commission is non-zero; the omitted commission inflates netPaid, yielding a slightly larger bonus than the liquidatee actually paid, causing small protocol loss.
**Insight:** When auditing settlement functions, check whether returned amounts are computed before or after fee/commission deductions—return values feeding bonus or payout math are prime spots for accounting drift.