# Commission share-burn distribution is JIT-capturable when builderCode == 0 (default)

Commission fees burned as shares when builderCode==0 instantly raise assetsPerShare, letting JIT depositors capture the distribution and self-rebate fees.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: fuzious
- Disclosed: 2026-03-09
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#m-15
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:fee-bypass vuln:flash-loan vuln:share-inflation

**Target:** CollateralTracker settleMint/settleBurn ERC4626 share accounting
**Root cause:** When feeRecipient==0, commissions are burned as shares without removing assets, so totalSupply drops while totalAssets stays constant, instantly raising assetsPerShare for current holders.
**Steps:**
1. Victim submits PanopticPool.dispatch with builderCode=0 (feeRecipient=0).
2. Attacker front-runs with CollateralTracker.deposit to mint dominant share balance.
3. Victim tx executes; settleMint/settleBurn hits `if (riskParameters.feeRecipient() == 0) { _burn(optionOwner, sharesToBurn); }`.
4. Attacker back-runs by withdrawing, capturing share-price uplift ≈ A/(T+A).
5. Active variant: deposit, call dispatchFrom on margin-called account routing to _liquidate → _burnAllOptionsFrom using hardcoded getRiskParameters(0), then exit atomically.
**How found:** Code reading of settleMint/settleBurn commission branch: noticed _burn without asset removal, then traced feeRecipient==0 to default builderCode==0 and to hardcoded getRiskParameters(0) in _burnAllOptionsFrom and _forceExercise, revealing attacker-triggerable burn events.
**Exploitation:** Attacker needs capital A ≈ p/(1-p)·T to capture fraction p of a burn event. Passive sandwich requires holding shares across the victim tx; active liquidation/force-exercise trigger allows single-tx flash-loan-funded entry→burn→exit. Profit bounded by maxWithdraw/maxRedeem capped at s_depositedAssets and blocked when numberOfLegs(owner)!=0.
**Escalation:** Chaining with liquidation/force-exercise paths that hardcode getRiskParameters(0) turns passive mempool sandwich into attacker-triggered atomic capture; also enables fee self-rebating where fee payer recaptures >99% of own commission.
**Insight:** In ERC4626-style vaults, any value distribution implemented as a share burn (supply down, assets flat) is JIT-capturable; check whether the burn trigger is attacker-controllable (e.g., liquidation paths hardcoding default params) to convert passive sandwich into atomic flash-loan capture.