# High divergence check in isSafeMode is unreachable dead code providing false sense of security

Panoptic RiskEngine's highDivergence safeMode check compares medianTick vs slowEMA against 1906 ticks, but shared clampedTick input bounds divergence to ~875, making the check dead code.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: anchabadze
- Disclosed: 2026-03-09
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#m-17
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-17
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** RiskEngine.sol isSafeMode / OraclePack oracle divergence check
**Root cause:** medianTick and slowEMA are both derived from the same clampedTick capped at MAX_CLAMP_DELTA=149 per epoch, mathematically bounding their divergence to ~875-935 ticks, far below the 1906-tick threshold.
**Steps:**
1. Read RiskEngine::isSafeMode() L929: `|medianTick - slowEMA| > 1906` adds +1 to safeMode
2. Trace OraclePack::insertObservation(): both medianTick and slowEMA updated from same clampedTick
3. Note clampTick() caps change at 149 ticks per 64s epoch
4. Compute equilibrium lag: slowEMA ~1397 ticks, medianTick ~522 ticks behind current tick
5. Derive max divergence ~875 (935 transient) < 1906 threshold
6. Run `forge test --match-path test/foundry/core/HighDivergenceTest.t.sol -vv` with PoC tests test_MathematicalProof_MaximumDivergence and test_HighDivergence_IsDeadCode
**How found:** Code-reading of the safeMode additive conditions; noticed both oracle metrics share the clampedTick input, then did equilibrium math on EMA lag and median-of-8 lag to bound divergence, confirmed empirically with extreme-scenario tests.
**Insight:** When two oracle metrics are derived from the same clamped input, their divergence is bounded by the clamp and lag dynamics—compute the theoretical max before trusting a divergence threshold; thresholds set as multiples of a clamp delta are often unreachable.