# State-price mismatch in liquidation

PanopticPool._liquidate values collateral from stale stored unrealizedInterest while debt is computed fresh, understating liquidatee net worth and overstating protocol loss.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: devdragon
- Disclosed: 2026-03-09
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#m-14
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** PanopticPool._liquidate / CollateralTracker.assetsAndInterest
**Root cause:** CollateralTracker.convertToAssets uses totalAssets() built on stored s_marketState.unrealizedInterest() only updated during _accrueInterest, while _owedInterest simulates the borrow index to the current timestamp, so assets and debt are valued at different times.
**Steps:**
1. Call PanopticPool._liquidate on a liquidatee after several blocks without interest accrual.
2. getMargin -> assetsAndInterest -> convertToAssets reads stale totalAssets (unrealizedInterest not updated).
3. _owedInterest computes debt fresh via _calculateCurrentInterestState to current block.
4. Observe net position value differs before vs after accrueInterest (PoC: 48565e18 vs 48612e18, ~4.76e16 mismatch).
5. Liquidation proceeds with understated collateral, triggering haircutPremia and reduced liquidator bonus.
**How found:** Code reading of _liquidate's getMargin path, comparing how assetsAndInterest derives assets (stored unrealizedInterest) versus debt (_owedInterest simulating current borrow index), spotting the timestamp mismatch.
**Exploitation:** Liquidator triggers liquidation while interest is unaccrued; protocol misjudges liquidatee as deeper in debt, revoking premiums from sellers via haircutPremia and underpaying the liquidator bonus.
**Insight:** When a valuation function mixes a stored accumulator (assets) with a freshly simulated one (debt), check whether both are advanced to the same timestamp; liquidation and bonus math amplify any skew.