Merge pull request #210 from lista-dao/feature/v3-rebalance-loss-cap

feat(provider + adaptor): bound rebalance loss on V3 LP collateral

Author: razww

src/liquidator/V3Liquidator.sol

@@ -54,6 +54,13 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
   /// @dev Whitelisted V3Provider contracts (collateral token = the provider itself).
   mapping(address => bool) public v3Providers;
 
+  /// @dev Pass-back of the leg amounts redeemed inside onMoolahLiquidate, so flashLiquidate can report
+  ///      the actual redeemed amount0 / amount1 in its V3Liquidation event rather than 0. Appended at
+  ///      the end of the storage layout (upgrade-safe). flashLiquidate zeroes them before each liquidate
+  ///      so a non-redeeming flash liquidation — or a stale value from an earlier call — reports 0.
+  uint256 private _redeemedAmount0;
+  uint256 private _redeemedAmount1;
+
   /* ──────────────────────────── events ────────────────────────────── */
 
   event TokenWhitelistChanged(address indexed token, bool status);
@@ -276,6 +283,11 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
     address effectiveToken0Spender = params.token0Spender == address(0) ? params.token0Pair : params.token0Spender;
     address effectiveToken1Spender = params.token1Spender == address(0) ? params.token1Pair : params.token1Spender;
 
+    // Clear any stale pass-back (e.g. from an earlier flashLiquidate in the same tx). The callback
+    // fills these in only when it redeems; a non-redeeming flash liquidation reports 0 / 0.
+    _redeemedAmount0 = 0;
+    _redeemedAmount1 = 0;
+
     (uint256 _seized, uint256 _repaid) = IMoolah(MOOLAH).liquidate(
       mp,
       borrower,
@@ -301,7 +313,7 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
       )
     );
 
-    emit V3Liquidation(id, params.v3Provider, borrower, _seized, _repaid, 0, 0);
+    emit V3Liquidation(id, params.v3Provider, borrower, _seized, _repaid, _redeemedAmount0, _redeemedAmount1);
   }
 
   /**
@@ -401,6 +413,10 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
       // leg is an ERC-20 sold via approve + call. Read it from the provider — never hardcode a chain.
       address wrappedNative = IV3Provider(d.v3Provider).WRAPPED_NATIVE();
 
+      // Snapshot before redeeming/swapping so profitability is judged on THIS liquidation's
+      // delta, not masked by loanToken balance already sitting idle from prior liquidations.
+      uint256 before = d.loanToken.balanceOf(address(this));
+
       // Redeem V3 shares → TOKEN0 + TOKEN1; the wrapped-native leg arrives as the native coin.
       (uint256 amount0, uint256 amount1) = IV3Provider(d.v3Provider).redeemShares(
         d.seized,
@@ -409,6 +425,10 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
         address(this)
       );
 
+      // Pass the actual redeemed amounts back to flashLiquidate for the V3Liquidation event.
+      _redeemedAmount0 = amount0;
+      _redeemedAmount1 = amount1;
+
       // Swap TOKEN0 → loanToken (skip if already loanToken or no swap requested).
       if (d.swapToken0 && amount0 > 0 && token0 != d.loanToken) {
         _swapRedeemedLeg(token0 == wrappedNative, d.token0Pair, d.token0Spender, token0, amount0, d.swapToken0Data);
@@ -427,7 +447,8 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
         if (nativeBalance > 0) IWBNB(wrappedNative).deposit{ value: nativeBalance }();
       }
 
-      if (d.loanToken.balanceOf(address(this)) < repaidAssets) revert NoProfit();
+      uint256 out = d.loanToken.balanceOf(address(this)) - before;
+      if (out < repaidAssets) revert NoProfit();
     }
 
     // Approve Moolah to pull the repayment (always done, flash or pre-funded).

src/provider/interfaces/IV3DexAdapter.sol

@@ -111,6 +111,11 @@ interface IV3DexAdapter {
   /// @notice Collect accrued fees and re-add them plus idle inventory as liquidity (compound).
   function collectAndCompound() external;
 
+  /// @notice Record tokens already transferred to the adapter as idle inventory, without minting into
+  ///         the pool. Used by the vault deposit path so new deposits enter as idle at the current fair
+  ///         composition (off-pool priced); a later spot-gated compound() deploys them.
+  function creditIdle(uint256 amount0, uint256 amount1) external;
+
   /* ─────────────────────── rebalance / rate config ────────────────── */
 
   /// @notice Exchange rate at the last successful center/init (rate-implied pairs; 0 for TWAP pairs).
@@ -129,12 +134,25 @@ interface IV3DexAdapter {
   ///         MANAGER). A venue may never be TOKEN0 / TOKEN1 / POOL / POSITION_MANAGER.
   function setSwapPairWhitelist(address swapPair, bool status) external;
 
+  /// @notice Per-swap rate-anchored loss cap for the rebalance conversion swap (ppm, 1e6 = 100%).
+  function maxSwapLossBp() external view returns (uint256);
+
+  /// @notice Set the per-swap rate-anchored loss cap (onlyRole MANAGER; ppm, 1e6 = 100%).
+  function setMaxSwapLossBp(uint256 maxSwapLossBp) external;
+
+  /// @notice Max |pool spot − fair| price deviation (bps) tolerated when adding liquidity at pool spot.
+  function maxSpotDeviationBps() external view returns (uint256);
+
+  /// @notice Set the spot-vs-fair deviation gate (onlyRole MANAGER; bps of price, 0 disables).
+  function setMaxSpotDeviationBps(uint256 maxSpotDeviationBps) external;
+
   /// @notice Recenter the position to its range and convert inventory to the optimal ratio.
   ///         onlyProvider — the provider gates the caller with the BOT role.
   function rebalance(
     uint256 minAmount0,
     uint256 minAmount1,
     uint256 minLiquidity,
+    uint160 targetSqrtPriceX96,
     uint256 deadline,
     bytes calldata swapData
   ) external;

src/provider/interfaces/IV3PoolMinimal.sol

@@ -13,4 +13,20 @@ pragma solidity 0.8.34;
  */
 interface IV3PoolMinimal {
   function slot0() external view returns (uint160 sqrtPriceX96, int24 tick);
+
+  /// @notice Global fee growth per unit of liquidity, Q128.
+  function feeGrowthGlobal0X128() external view returns (uint256);
+
+  function feeGrowthGlobal1X128() external view returns (uint256);
+
+  /// @notice Tick state. Decodes only the first four fields (liquidityGross, liquidityNet,
+  ///         feeGrowthOutside0X128, feeGrowthOutside1X128) — the two fee-growth values are all the
+  ///         pending-fee simulation needs, and stopping the decode there keeps the read width-agnostic
+  ///         across V3 flavors (see the slot0 note above).
+  function ticks(
+    int24 tick
+  )
+    external
+    view
+    returns (uint128 liquidityGross, int128 liquidityNet, uint256 feeGrowthOutside0X128, uint256 feeGrowthOutside1X128);
 }

src/provider/interfaces/IV3Provider.sol

@@ -26,14 +26,20 @@ interface IV3Provider is IProvider {
   /// @notice Total token0/token1 backing the vault at the current pool spot (display/bots).
   function getTotalAmounts() external view returns (uint256 total0, uint256 total1);
 
+  /// @notice Total token0/token1 backing the vault at the FAIR price (idle + fees included). This is the
+  ///         ratio a subsequent deposit binds to; size deposit legs in this ratio to minimise the refund.
+  function getFairComposition() external view returns (uint256 total0, uint256 total1);
+
   /// @notice Deposit token0/token1 into the V3 position and supply resulting shares as Moolah
-  ///         collateral on behalf of `onBehalf`.
+  ///         collateral on behalf of `onBehalf`. Reverts if the minted shares are below `minShares`
+  ///         (share-slippage floor; pass 0 to disable).
   function deposit(
     MarketParams calldata marketParams,
     uint256 amount0Desired,
     uint256 amount1Desired,
     uint256 amount0Min,
     uint256 amount1Min,
+    uint256 minShares,
     address onBehalf
   ) external payable returns (uint256 shares, uint256 amount0Used, uint256 amount1Used);
 

src/provider/libraries/SwapInventoryLib.sol

@@ -36,6 +36,7 @@ library SwapInventoryLib {
   error ExceedAmountIn();
   error InsufficientOutput();
   error UnexpectedNative();
+  error InsufficientInventory();
 
   /// @notice Execute one backend-built swap. `sellToken0` ⇒ sell token0 for token1, else token1 for
   ///         token0. `nativeIn` ⇒ the venue takes the native coin for the wrapped-native input leg
@@ -60,8 +61,11 @@ library SwapInventoryLib {
     address tokenOut = sellToken0 ? token1 : token0;
 
     uint256 avail = sellToken0 ? total0 : total1;
-    if (amountIn > avail) amountIn = avail; // never spend more than the position holds
-    if (amountIn == 0) return (total0, total1);
+    if (avail == 0) return (total0, total1); // nothing to sell
+
+    // Stale swapData (requested > held): fail fast. Capping would desync the venue allowance from
+    // swapData and could underflow the totals. Now amountIn <= avail, so the allowance matches the pull.
+    if (amountIn > avail) revert InsufficientInventory();
 
     uint256 beforeIn = IERC20(tokenIn).balanceOf(address(this));
     uint256 beforeOut = IERC20(tokenOut).balanceOf(address(this));
@@ -83,10 +87,13 @@ library SwapInventoryLib {
 
     // Wrap any native this call delivered — a native-out venue's proceeds (instantWithdraw → BNB) or a
     // native-in venue's unspent refund — back into the wrapped-native ERC-20, so it is booked into the
-    // totals via the spent/received deltas and never stranded. Native can only belong to the
-    // wrapped-native leg; if neither leg is it, there is nowhere to book the native ⇒ revert.
-    if (address(this).balance > beforeNative) {
-      if (tokenIn != wrappedNative && tokenOut != wrappedNative) revert UnexpectedNative();
+    // totals via the spent/received deltas and never stranded. Only a wrapped-native leg can legitimately
+    // deliver native; wrap the delta ONLY when either leg is the wrapped-native token. If NEITHER leg is
+    // (an ERC-20↔ERC-20 swap on a future non-native pair), any native that appears is an unsolicited
+    // donation the venue forwarded (e.g. a router that sweeps its native balance; an attacker can seed it
+    // with 1 wei) — it is not part of this swap's accounting, so leave it untouched rather than reverting
+    // and bricking the rebalance.
+    if ((tokenIn == wrappedNative || tokenOut == wrappedNative) && address(this).balance > beforeNative) {
       IWBNB(wrappedNative).deposit{ value: address(this).balance - beforeNative }();
     }
 

src/provider/v3/SlisBNBV3DexAdapter.sol

@@ -58,18 +58,10 @@ contract SlisBNBV3DexAdapter is V3DexAdapter, ISlisBNBV3DexAdapter {
 
   /* ───────────────────────── hook overrides ───────────────────────── */
 
-  /// @dev slisBNB↔BNB rate from the StakeManager (1e18). 0 for any non-slisBNB/WBNB pair → base TWAP.
+  /// @dev slisBNB↔BNB rate from the StakeManager (1e18). The constructor pins TOKEN0 == slisBNB and
+  ///      TOKEN1 == WBNB, so the pair/order is fixed at deploy and the rate is always the direct
+  ///      slisBNB→BNB conversion (no runtime pair/order branch needed).
   function _lstNativeRate() internal view override returns (uint256) {
-    return _isSlisBnbWbnbPool() ? _poolPriceRate() : 0;
-  }
-
-  /* ─────────────────────────── internals ──────────────────────────── */
-
-  function _isSlisBnbWbnbPool() internal view returns (bool) {
-    return (TOKEN0 == SLISBNB && TOKEN1 == WBNB) || (TOKEN0 == WBNB && TOKEN1 == SLISBNB);
-  }
-
-  function _poolPriceRate() internal view returns (uint256) {
-    return TOKEN0 == SLISBNB ? STAKE_MANAGER.convertSnBnbToBnb(1e18) : STAKE_MANAGER.convertBnbToSnBnb(1e18);
+    return STAKE_MANAGER.convertSnBnbToBnb(1e18);
   }
 }

src/provider/v3/SlisBNBV3Provider.sol

@@ -59,10 +59,11 @@ contract SlisBNBV3Provider is V3Provider {
     uint256 minAmount0,
     uint256 minAmount1,
     uint256 minLiquidity,
+    uint160 targetSqrtPriceX96,
     uint256 deadline,
     bytes calldata swapData
   ) external onlyRole(BOT) nonReentrant {
-    ISlisBNBV3DexAdapter(ADAPTER).rebalance(minAmount0, minAmount1, minLiquidity, deadline, swapData);
+    _guardedRebalance(minAmount0, minAmount1, minLiquidity, targetSqrtPriceX96, deadline, swapData);
   }
 
   /* ─────────────────── slisBNBx: sync / view ──────────────────────── */
@@ -85,6 +86,9 @@ contract SlisBNBV3Provider is V3Provider {
     uint256 price0 = IOracle(resilientOracle).peek(TOKEN0); // 8-decimal USD
     uint256 price1 = IOracle(resilientOracle).peek(TOKEN1); // 8-decimal USD
     uint256 bnbPrice = IOracle(resilientOracle).peek(BNB_ADDRESS); // 8-decimal USD
+    // Fail closed on a broken feed: a transiently-zero price would understate (possibly zero) the BNB
+    // value and make the slisBNBx minter burn the user's reward balance toward 0. Revert instead.
+    if (price0 == 0 || price1 == 0 || bnbPrice == 0) revert OracleZero();
 
     uint256 value0 = (user0 * price0 * 1e18) / (10 ** DECIMALS0);
     uint256 value1 = (user1 * price1 * 1e18) / (10 ** DECIMALS1);