# PLPs can withdraw assets needed by long positions, temporarily locking buyers

CollateralTracker.maxWithdraw lets LPs drain liquidity backing long positions, so long holders cannot close or force-exercise, temporarily locking funds.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: Henri
- Disclosed: 2026-03-09
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#m-10
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** CollateralTracker.sol maxWithdraw / PanopticPool collateral accounting
**Root cause:** maxWithdraw only reserves 1 wei (s_depositedAssets - 1) and does not reserve tokens pulled in to back open long positions, so LPs can withdraw liquidity longs need to return borrowed amounts to the AMM on close.
**Steps:**
1. LP Bob deposits 100 ETH into vault0; seller deposits 5 ETH; Alice deposits 1 ETH -> s_depositedAssets = 106 ETH
2. Seller shorts a 10 ETH call on chunk A; Alice longs a 1 ETH call -> s_depositedAssets = 97 ETH
3. Bob calls withdraw for 97 ETH (his balance exceeds s_depositedAssets) -> s_depositedAssets = 0
4. Alice attempts to close her long; SPFM must return 1 ETH from positionManager to AMM -> reverts
5. forceExercise cannot help: pure shorts cannot be force-exercised and mixed positions only replenish by delta
**How found:** Code review of maxWithdraw's reserve logic (only s_depositedAssets - 1 held back) combined with tracing token flow when longs are opened: tokens pulled from AMM raise s_depositedAssets but are not reserved, so LPs can withdraw them.
**Exploitation:** A whale LP waits until utilization is high (shorts >> longs, low s_depositedAssets), then withdraws all available liquidity via maxWithdraw, leaving zero collateral backing. Long holders then cannot burnOptions or forceExercise because the pool cannot return borrowed tokens to the AMM, trapping them in losing positions.
**Escalation:** High utilization makes s_depositedAssets small and easy to deplete; low netLiquidity on a chunk also blocks shorts from closing since they need forceExercise of longs.
**Insight:** When auditing collateral/vault accounting, check whether tokens credited on position open are actually reserved against future close obligations; a 'minus 1 wei' reserve is a red flag that open-position liabilities aren't tracked in maxWithdraw.