https://github.com/code-423n4/2024-09-panoptic/blob/main/contracts/CollateralTracker.sol#L489
https://github.com/code-423n4/2024-09-panoptic/blob/main/contracts/CollateralTracker.sol#L593
CollateralTracker is a ERC4626 compliant vault. However, in some cases, the maxWithdraw/maxRedeem functions may revert.
According to the README: Panoptics CollateralTracker supports the full ERC4626 interface. In the scope of this audit, a new change was introduced when calculating maxWithdraw/maxRedeem that it uses s_poolAssets - 1 as available asset balance since there was 1 wei of virtual balance in the beginning.
However, it is possible that s_poolAssets is zero. When users are minting short positions (equivalent to minting UniswapV3 LP), tokens are sent to UniswapV3. If the amount of tokens happens to be exactly the remainder asset of a CollateralTracker, the updated s_poolAssets would turn to zero.
For both functions, if s_poolAssets == 0, simply return 0.
dyedm1 (Panoptic) confirmed and commented:
Picodes (judge) decreased severity to Low and commented:
