{"investigation":{"slug":"panoptic-v11","entity_name":"Panoptic V1.1","trust_score":66,"severity_base":66,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Panoptic V1.1 is a permissionless, oracle-free perpetual options protocol built on Uniswap V3 liquidity positions, developed by Panoptic Labs and incubated by Advanced Blockchain AG. On August 25, 2025, a Cantina researcher disclosed a critical position-spoofing vulnerability rooted in the protocol's XOR-based fingerprinting system, placing approximately $4–5 million in user funds at risk. A coordinated whitehat rescue secured over 98% of remaining at-risk funds, and ZachXBT flagged the incident, contributing to reduced community trust in the V1.1 deployment.","sections":[{"content":"Panoptic V1.1 is a DeFi options protocol that enables perpetual, oracle-free options trading on any Uniswap V3 liquidity pool. The protocol was conceived by Guillaume Lambert, an assistant professor of applied and engineering physics at Cornell University, who observed that concentrated liquidity provisioning in Uniswap V3 is mathematically equivalent to selling options in traditional finance. Panoptic Labs, Inc. develops the protocol, with incubation support from Advanced Blockchain AG (Frankfurt Stock Exchange: ABO). Options in Panoptic do not expire, require no price oracle, and are priced based on accumulated Uniswap V3 fees rather than an external feed. The protocol raised $4.5 million in a December 2022 seed round led by gumi Cryptos Capital, with participation from Uniswap Labs Ventures, Coinbase Ventures, and Jane Street. A second $7 million seed round closed in November 2023, led by Greenfield Capital with participation from HashKey, Zee Prime Capital, and others, bringing total disclosed funding to $11.5 million. Panoptic V1.0 launched on Ethereum mainnet in mid-2024. V1.1 followed as an incremental protocol upgrade. As of late 2025, V1.1's total value locked had declined sharply following the August 2025 security incident, with DeFiLlama reporting approximately $2,373 in TVL distributed across Base, Unichain, and Ethereum.","heading":"Overview","sources":[{"url":"https://panoptic.xyz/blog/panoptic-defi-options-protocol-introduction","name":"panoptic.xyz","type":"other","credibility":3},{"url":"https://www.advancedblockchain.com/blogs/how-advanced-blockchain-synergized-and-built-panoptic","name":"advancedblockchain.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/192207/uniswap-based-defi-protocol-panoptic-raises-4-5-million","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/263771/panoptic-raises-7-million-to-build-perpetual-options-platform-for-defi","name":"theblock.co","type":"other","credibility":3},{"url":"https://defillama.com/protocol/panoptic-v1.1","name":"defillama.com","type":"other","credibility":3},{"url":"https://arxiv.org/pdf/2204.14232","name":"arxiv.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Panoptic's core mechanism treats Uniswap V3 concentrated liquidity positions as synthetic options. Depositing liquidity within a price range is analogous to writing a short put or short call, while borrowing that liquidity is equivalent to purchasing a long option. The protocol uses a SemiFungiblePositionManager (SFPM) contract to manage LP positions as ERC-1155 tokens, enabling complex multi-leg options strategies. Options are encoded as packed integer values called TokenIDs, which store strike price, option type, and range information in a single uint256. To reduce gas costs at scale, rather than storing full position arrays on-chain, the protocol implemented a fingerprinting system that compressed position lists into a single hash using XOR operations over keccak256 hashes. The PanopticPool contract verifies a user's alleged open positions by re-deriving this fingerprint from a caller-supplied list and matching it to the stored on-chain hash. This design — chosen for gas efficiency — became the root cause of the August 2025 vulnerability. The protocol is deployed across Ethereum mainnet, Base, and Unichain, and supports permissionless pool creation for any Uniswap V3 market pair.","heading":"Protocol Architecture","sources":[{"url":"https://panoptic.xyz/research/introducing-panoptic-smart-contracts","name":"panoptic.xyz","type":"other","credibility":3},{"url":"https://github.com/panoptic-labs/panoptic-v1-core","name":"github.com","type":"other","credibility":3},{"url":"https://panoptic.xyz/blog/position-spoofing-post-mortem","name":"panoptic.xyz","type":"other","credibility":3},{"url":"https://arxiv.org/html/2204.14232v3","name":"arxiv.org","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 25, 2025, a researcher affiliated with Cantina reported a critical vulnerability to the Panoptic team. The flaw affected the protocol's XOR-based position list fingerprinting system and could enable an attacker to drain all funds from any PanopticPool contract by bypassing collateral checks through position spoofing. The technical root cause involved two intersecting weaknesses: first, the PanopticPool did not validate that the TokenIDs in a caller-supplied position list corresponded to positions the caller actually held; second, the XOR fingerprinting scheme — effectively a variant of the known-insecure XHASH construction — is vulnerable to collision attacks solvable in polynomial time via Gaussian elimination over GF(2). An attacker with knowledge of a target user's real position fingerprint could construct a fake position list with an identical fingerprint, one that falsely indicates zero collateral requirements. Combined with a flash loan, this would permit leveraged positions to be opened and funds withdrawn without any real collateral backing. The Panoptic team confirmed the vulnerability's feasibility within approximately four hours of receipt. Over the following 72 hours, the team notified users via Discord, email, and SEAL 911, prompting voluntary withdrawals. By August 26, approximately $2.35 million had been withdrawn voluntarily. Roughly $1.6 million remained at risk by August 27. On August 28 at 5:55 PM EDT, the team executed a whitehat rescue on Ethereum mainnet at block 23242436, followed by additional rescues on Base and Unichain. In total, over 98% of at-risk funds — approximately $550,000 that required active intervention — were secured without user loss. All rescued funds were transferred to vault.panoptic.eth and made reclaimable through a Merkle-root proof system with in-kind redistribution (no asset conversion). The Cantina researcher who disclosed the vulnerability received the protocol's maximum bug bounty of $250,000. Post-incident analysis noted that two findings from Panoptic's April 2024 Code4rena audit had surfaced partial indicators of this attack class — specifically, reports describing how users could liquidate others without being solvent and how insolvent users could mint additional options — but neither fully traced the exploit path to the fingerprinting system.","heading":"Incident Details — August 2025 Position Spoofing Vulnerability","sources":[{"url":"https://panoptic.xyz/blog/position-spoofing-post-mortem","name":"panoptic.xyz","type":"other","credibility":3},{"url":"https://x.com/Panoptic_xyz/status/1964010635026715015","name":"x.com","type":"other","credibility":3},{"url":"https://cantina.xyz/bounties/01da0370-eacb-48a2-a2df-3aa44f7bc838","name":"cantina.xyz","type":"other","credibility":3},{"url":"https://panoptic.xyz/blog/panoptic-september-2025-newsletter","name":"panoptic.xyz","type":"other","credibility":3}],"severity":"medium"},{"content":"The primary whitehat rescue was executed on Ethereum mainnet at block 23242436 on August 28, 2025. All recovered assets were directed to the ENS address vault.panoptic.eth, which serves as the distribution multisig for the Merkle-root claim system. Panoptic V1.1 is deployed across three EVM chains: Ethereum mainnet, Base (contract 0xa32b14c4e35d1a1cdd2bbe06213ba90eddb1433c on BaseScan), and Unichain. The SemiFungiblePositionManager is documented in Panoptic's canonical deployment references with an Ethereum address of 0x1393ad734EA3c52865b4B541cf049dafd25c23a5. The CREATE3 factory used for deterministic deployment is at 0x000000000000b361194cfe6312EE3210d53C15AA. Following the incident, DeFiLlama's real-time TVL tracker for Panoptic V1.1 reported a combined TVL of approximately $2,373 across all chains, a substantial decline from the estimated $4–5 million that was at risk at the time of the disclosure, reflecting either completed withdrawals and rescues or user flight from the protocol post-incident. The on-chain forensics were classified by DeFiLlama as a Protocol Logic vulnerability affecting all three deployed chains simultaneously.","heading":"On-Chain Evidence","sources":[{"url":"https://panoptic.xyz/blog/position-spoofing-post-mortem","name":"panoptic.xyz","type":"other","credibility":3},{"url":"https://defillama.com/protocol/panoptic-v1.1","name":"defillama.com","type":"other","credibility":3},{"url":"https://basescan.org/address/0xa32b14c4e35d1a1cdd2bbe06213ba90eddb1433c","name":"basescan.org","type":"other","credibility":3},{"url":"https://etherscan.io/address/0x1393ad734EA3c52865b4B541cf049dafd25c23a5","name":"etherscan.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Guillaume Lambert is the founder and CEO of Panoptic. Lambert holds a BS in Physics from McGill University (2004–2007) and a PhD in Physics from Princeton University (2007–2011). He subsequently held postdoctoral and visiting scholar positions at the University of Chicago and Harvard's Wyss Institute, before serving as an assistant professor of applied and engineering physics at Cornell University from July 2016. His transition to DeFi began during the COVID-19 pandemic, when he became an active liquidity provider on Uniswap V3 after its 2021 launch and independently derived the mathematical equivalence between concentrated LP positions and options payoffs. Lambert published the foundational Panoptic whitepaper on arXiv in April 2022. Advanced Blockchain AG, a publicly listed German blockchain venture studio (Frankfurt Stock Exchange: ABO), served as Panoptic's original build partner and incubator, contributing engineering, marketing, and product resources. Panoptic Labs, Inc. operates the protocol as an independent entity following incubation. The Uniswap Foundation has featured Lambert as a builder story and awarded Panoptic a grant for the gRHO platform, which launched on Uniswap V4.","heading":"Team and Background","sources":[{"url":"https://theorg.com/org/panoptic/org-chart/guillaume-lambert","name":"theorg.com","type":"other","credibility":3},{"url":"https://www.uniswapfoundation.org/blog/builder-stories-guillaume-lambert-on-transforming-the-lp-experience","name":"uniswapfoundation.org","type":"other","credibility":3},{"url":"https://www.advancedblockchain.com/blogs/how-advanced-blockchain-synergized-and-built-panoptic","name":"advancedblockchain.com","type":"other","credibility":3},{"url":"https://arxiv.org/pdf/2204.14232","name":"arxiv.org","type":"other","credibility":3},{"url":"https://uniswapfoundation.mirror.xyz/2ic8OAy1a5VjZfZacWp54J3LMbeT7hLrx635D7CBcFg","name":"uniswapfoundation.mirror.xyz","type":"other","credibility":3}],"severity":"medium"},{"content":"Panoptic conducted multiple third-party audits prior to the August 2025 incident. For V1.0: Code4rena completed an initial audit in April 2024, which identified 2 high-severity and 9 medium-severity findings, including two reports that partially foreshadowed the eventual position-spoofing attack vector. A second Code4rena audit in June 2024 found zero high- or medium-severity vulnerabilities. A final Code4rena review completed October 10, 2024 again found no high or medium severity issues. For V1.1: Cantina completed an initial review on November 7, 2024 and a final review on November 20, 2024. Code4rena conducted a V1.1 review finalized January 28, 2025. None of these V1.1 audits identified the XOR fingerprinting collision flaw that was disclosed in August 2025. This represents a significant audit miss for what the Cantina researcher ultimately classified as a critical severity vulnerability with a $250,000 maximum bounty payout. Post-incident, Panoptic announced a V2 protocol with three planned audits: Obsidian (Audit 1), Nethermind (Audit 2), and a competitive audit (Audit 3). A December 2025 Code4rena competitive audit for Panoptic Next Core was also listed. Panoptic maintains an active bug bounty program on Cantina.","heading":"Audit History","sources":[{"url":"https://panoptic.xyz/docs/security/security_audits","name":"panoptic.xyz","type":"other","credibility":3},{"url":"https://code4rena.com/reports/2024-04-panoptic","name":"code4rena.com","type":"other","credibility":3},{"url":"https://code4rena.com/audits/2023-11-panoptic","name":"code4rena.com","type":"other","credibility":3},{"url":"https://cantina.xyz/bounties/01da0370-eacb-48a2-a2df-3aa44f7bc838","name":"cantina.xyz","type":"other","credibility":3},{"url":"https://code4rena.com/audits/2025-12-panoptic-next-core","name":"code4rena.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The August 2025 position-spoofing vulnerability represents a high-severity protocol risk that was not detected across five separate audits spanning approximately fourteen months. While no user funds were ultimately lost due to successful whitehat coordination, the vulnerability was exploitable at the time of disclosure and required emergency intervention rather than an on-chain fix. The fact that early indicators of the attack class appeared in the April 2024 Code4rena audit — reports describing position list manipulation — and were not traced to the underlying fingerprinting system represents a systemic gap in the audit process. The reliance on XOR-based hashing for a security-critical collateral check, rather than explicit on-chain position storage or more robust cryptographic commitments, reflects an architectural risk trade-off (gas efficiency vs. security) that was not adequately adversarially tested. Current V1.1 TVL is negligible ($2,373 as of late 2025), suggesting users have largely exited the deployment. The protocol's roadmap has shifted to V2, which incorporates a redesigned validation model. Panoptic's incident response — voluntary user notification, SEAL 911 coordination, whitehat execution, and in-kind fund return — is consistent with responsible post-incident behavior. ZachXBT flagged the entity, consistent with community-level concern following the incident disclosure. The ongoing Cantina bug bounty and multiple planned V2 audits indicate continued investment in security infrastructure, but the V1.1 deployment should be treated as deprecated and high-risk until V2 is independently verified.","heading":"Risk Assessment","sources":[{"url":"https://panoptic.xyz/blog/position-spoofing-post-mortem","name":"panoptic.xyz","type":"other","credibility":3},{"url":"https://defillama.com/protocol/panoptic-v1.1","name":"defillama.com","type":"other","credibility":3},{"url":"https://code4rena.com/reports/2024-04-panoptic","name":"code4rena.com","type":"other","credibility":3},{"url":"https://cantina.xyz/bounties/01da0370-eacb-48a2-a2df-3aa44f7bc838","name":"cantina.xyz","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-04-28","event":"Guillaume Lambert publishes the Panoptic whitepaper on arXiv, establishing the theoretical basis for perpetual oracle-free options via Uniswap V3 LP positions.","source":""},{"date":"2022-12","event":"Panoptic closes a $4.5 million seed round led by gumi Cryptos Capital, with Uniswap Labs Ventures, Coinbase Ventures, and Jane Street participating.","source":"","date_original":"2022-12-01"},{"date":"2023-11","event":"Panoptic launches its first Code4rena competitive audit.","source":"","date_original":"2023-11-01"},{"date":"2023-11","event":"Panoptic closes a $7 million seed round led by Greenfield Capital, bringing total disclosed funding to $11.5 million.","source":"","date_original":"2023-11-01"},{"date":"2024-04-22","event":"Code4rena April 2024 audit identifies 2 high-severity and 9 medium-severity findings, including two reports partially describing position list manipulation weaknesses.","source":""},{"date":"2024-06-10","event":"Code4rena June 2024 follow-up audit finds zero high- or medium-severity issues.","source":""},{"date":"2024-10-10","event":"Code4rena final V1.0 review finds no high or medium severity issues. Protocol prepares for mainnet launch.","source":""},{"date":"2024-11-07","event":"Cantina completes initial V1.1 protocol audit.","source":""},{"date":"2024-11-20","event":"Cantina completes final V1.1 protocol audit.","source":""},{"date":"2025-01-28","event":"Code4rena completes V1.1 protocol review with two independent wardens. No critical findings disclosed publicly.","source":""},{"date":"2025-08-25","event":"A Cantina researcher reports a critical position-spoofing vulnerability to the Panoptic team. The flaw involves XOR-based fingerprinting susceptible to polynomial-time collision attacks. Panoptic confirms feasibility within four hours and begins emergency user notifications.","source":""},{"date":"2025-08-26","event":"Approximately $2.35 million is voluntarily withdrawn by users following emergency notifications.","source":""},{"date":"2025-08-27","event":"Approximately $1.6 million remains at risk. Team continues outreach via Discord and SEAL 911.","source":""},{"date":"2025-08-28","event":"Primary whitehat rescue executed on Ethereum mainnet at block 23242436 at 5:55 PM EDT. Subsequent rescues completed on Base and Unichain. Over 98% of remaining at-risk funds secured. All recovered assets transferred to vault.panoptic.eth.","source":""},{"date":"2025-08-28","event":"Cantina researcher awarded $250,000 maximum bug bounty for responsible disclosure.","source":""},{"date":"2025-09","event":"Panoptic publishes the position-spoofing post-mortem and September newsletter detailing the incident, technical root cause, and fund recovery process.","source":"","date_original":"2025-09-01"}],"sources_used":[{"url":"https://panoptic.xyz/blog/panoptic-defi-options-protocol-introduction","name":"panoptic.xyz","type":"other","archive_url":"http://web.archive.org/web/20260517174450/https://panoptic.xyz/blog/panoptic-defi-options-protocol-introduction","credibility":3,"archive_timestamp":"2026-05-17T17:44:50+00:00"},{"url":"https://www.advancedblockchain.com/blogs/how-advanced-blockchain-synergized-and-built-panoptic","name":"advancedblockchain.com","type":"other","archive_url":"http://web.archive.org/web/20260520034408/https://www.advancedblockchain.com/blogs/how-advanced-blockchain-synergized-and-built-panoptic","credibility":3,"archive_timestamp":"2026-05-20T03:44:08+00:00"},{"url":"https://www.theblock.co/post/192207/uniswap-based-defi-protocol-panoptic-raises-4-5-million","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260426033242/https://www.theblock.co/post/192207/uniswap-based-defi-protocol-panoptic-raises-4-5-million","credibility":3,"archive_timestamp":"2026-04-26T03:32:42+00:00"},{"url":"https://www.theblock.co/post/263771/panoptic-raises-7-million-to-build-perpetual-options-platform-for-defi","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260426033242/https://www.theblock.co/post/263771/panoptic-raises-7-million-to-build-perpetual-options-platform-for-defi","credibility":3,"archive_timestamp":"2026-04-26T03:32:42+00:00"},{"url":"https://defillama.com/protocol/panoptic-v1.1","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250914210801/https://defillama.com/protocol/panoptic-v1.1","credibility":3,"archive_timestamp":"2025-09-14T21:08:01+00:00"},{"url":"https://arxiv.org/pdf/2204.14232","name":"arxiv.org","type":"other","archive_url":"http://web.archive.org/web/20260307102326/https://arxiv.org/pdf/2204.14232","credibility":3,"archive_timestamp":"2026-03-07T10:23:26+00:00"},{"url":"https://panoptic.xyz/research/introducing-panoptic-smart-contracts","name":"panoptic.xyz","type":"other","archive_url":"http://web.archive.org/web/20260516030048/https://panoptic.xyz/research/introducing-panoptic-smart-contracts","credibility":3,"archive_timestamp":"2026-05-16T03:00:48+00:00"},{"url":"https://github.com/panoptic-labs/panoptic-v1-core","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260827192020/https://github.com/panoptic-labs/panoptic-v1-core","credibility":3,"archive_timestamp":"2026-08-27T19:20:20+00:00"},{"url":"https://panoptic.xyz/blog/position-spoofing-post-mortem","name":"panoptic.xyz","type":"other","archive_url":"http://web.archive.org/web/20260521050118/https://panoptic.xyz/blog/position-spoofing-post-mortem","credibility":3,"archive_timestamp":"2026-05-21T05:01:18+00:00"},{"url":"https://arxiv.org/html/2204.14232v3","name":"arxiv.org","type":"other","archive_url":"https://web.archive.org/web/20260830031648/https://arxiv.org/html/2204.14232v3","credibility":3,"archive_timestamp":"2026-08-30T03:16:48+00:00"},{"url":"https://x.com/Panoptic_xyz/status/1964010635026715015","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cantina.xyz/bounties/01da0370-eacb-48a2-a2df-3aa44f7bc838","name":"cantina.xyz","type":"other","archive_url":"http://web.archive.org/web/20260421125924/https://cantina.xyz/bounties/01da0370-eacb-48a2-a2df-3aa44f7bc838","credibility":3,"archive_timestamp":"2026-04-21T12:59:24+00:00"},{"url":"https://panoptic.xyz/blog/panoptic-september-2025-newsletter","name":"panoptic.xyz","type":"other","archive_url":"http://web.archive.org/web/20260413232007/https://panoptic.xyz/blog/panoptic-september-2025-newsletter","credibility":3,"archive_timestamp":"2026-04-13T23:20:07+00:00"},{"url":"https://basescan.org/address/0xa32b14c4e35d1a1cdd2bbe06213ba90eddb1433c","name":"basescan.org","type":"other","archive_url":"https://web.archive.org/web/20260830031651/https://basescan.org/address/0xa32b14c4e35d1a1cdd2bbe06213ba90eddb1433c","credibility":3,"archive_timestamp":"2026-08-30T03:16:51+00:00"},{"url":"https://etherscan.io/address/0x1393ad734EA3c52865b4B541cf049dafd25c23a5","name":"etherscan.io","type":"other","archive_url":"http://web.archive.org/web/20260512041017/https://etherscan.io/address/0x1393ad734EA3c52865b4B541cf049dafd25c23a5","credibility":3,"archive_timestamp":"2026-05-12T04:10:17+00:00"},{"url":"https://theorg.com/org/panoptic/org-chart/guillaume-lambert","name":"theorg.com","type":"other","archive_url":"https://web.archive.org/web/20260829231003/https://theorg.com/org/panoptic?p=guillaume-lambert","credibility":3,"archive_timestamp":"2026-08-29T23:10:03+00:00"},{"url":"https://www.uniswapfoundation.org/blog/builder-stories-guillaume-lambert-on-transforming-the-lp-experience","name":"uniswapfoundation.org","type":"other","archive_url":"http://web.archive.org/web/20260121054520/https://www.uniswapfoundation.org/blog/builder-stories-guillaume-lambert-on-transforming-the-lp-experience","credibility":3,"archive_timestamp":"2026-01-21T05:45:20+00:00"},{"url":"https://uniswapfoundation.mirror.xyz/2ic8OAy1a5VjZfZacWp54J3LMbeT7hLrx635D7CBcFg","name":"uniswapfoundation.mirror.xyz","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://panoptic.xyz/docs/security/security_audits","name":"panoptic.xyz","type":"other","archive_url":"http://web.archive.org/web/20260413231636/https://panoptic.xyz/docs/security/security_audits","credibility":3,"archive_timestamp":"2026-04-13T23:16:36+00:00"},{"url":"https://code4rena.com/reports/2024-04-panoptic","name":"code4rena.com","type":"other","archive_url":"http://web.archive.org/web/20260606103453/https://code4rena.com/reports/2024-04-panoptic","credibility":3,"archive_timestamp":"2026-06-06T10:34:53+00:00"},{"url":"https://code4rena.com/audits/2023-11-panoptic","name":"code4rena.com","type":"other","archive_url":"http://web.archive.org/web/20260613122548/https://code4rena.com/audits/2023-11-panoptic","credibility":3,"archive_timestamp":"2026-06-13T12:25:48+00:00"},{"url":"https://code4rena.com/audits/2025-12-panoptic-next-core","name":"code4rena.com","type":"other","archive_url":"http://web.archive.org/web/20260412191321/https://code4rena.com/audits/2025-12-panoptic-next-core","credibility":3,"archive_timestamp":"2026-04-12T19:13:21+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:16.063436+00:00","updated_at":"2026-10-10T18:47:24.721+00:00"},"source_quality":{"total":22,"tier1":2,"tier2":2,"tier3":1,"unrated":17},"follower_count":null,"content_updated_at":"2026-10-10T18:47:25.040Z","last_fact_checked_at":"2026-08-27T11:04:49.818Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}