# Wide-range short legs can revert solvency checks and block liquidations (Errors.InvalidTick)

Wide-range short legs compute getSqrtRatioAtTick(tickUpper-tickLower), which exceeds the valid tick domain and reverts solvency checks, bricking liquidations.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: edoscoba
- Disclosed: 2026-03-09
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#m-08
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** RiskEngine._getRequiredCollateralSingleLegNoPartner / Math.getSqrtRatioAtTick
**Root cause:** In-range interpolation computes scaleFactor from getSqrtRatioAtTick(tickUpper - tickLower); the difference can exceed 887272 even though each endpoint is valid, so the call reverts with Errors.InvalidTick().
**Steps:**
1. Create a short leg with width*tickSpacing such that tickUpper - tickLower > 887272, current tick outside range.
2. Ensure solvency check passes while out-of-range (in-range branch not taken).
3. Move market tick into [tickLower, tickUpper).
4. Call riskEngine.isAccountSolvent(...) or any liquidation path; it reverts with Errors.InvalidTick().
5. Run `forge test --match-contract WideRangeShortInRangeSqrtRatioRevertPoC -vvv` to reproduce.
**How found:** Code reading of the in-range interpolation branch: noticed getSqrtRatioAtTick is called on the range width rather than endpoints, and that width can exceed the tick domain despite endpoint validation.
**Exploitation:** Attacker opens a wide-range short position while price is out of range; once price enters the range, all solvency-gated operations for that account revert, making it insolvent-but-unliquidatable and risking protocol bad debt.
**Escalation:** Same revert DoSes collateral-withdraw eligibility and any path calling isAccountSolvent at an in-range tick.
**Insight:** When a function validates inputs individually but then feeds their difference/sum into a domain-limited helper, check whether the derived value can escape the domain; range widths (width*tickSpacing) are a classic source.