fix(v3-lp): liquidator profit/receiver guards, deposit preview rounding, range params

Liquidator:
- onMoolahLiquidate counts native in the before-snapshot when the loan token is
  the wrapped-native, so stray native from earlier redemptions or receive()
  donations no longer reads as fresh profit and lets a shortfall clear NoProfit.
- redeemV3Shares requires receiver == self when a fundSource is set, keeping
  vault-funded proceeds inside the reflow path.
- setReflowBlacklist rejects a no-op status change, matching the other setters.

Provider:
- previewDepositAmounts rounds the leg amounts UP, matching _quoteDeposit, so the
  preview reports exactly what deposit() consumes.
- Range half-width INITIAL_RANGE_BPS 100 -> 50 (+/-0.5%), which also tightens the
  maxSpotDeviationBps and maxTwapDeviationBps defaults; centerRateThresholdBps
  drops to 1bp so the BOT, not the contract, picks the rebalance cadence.
- Correct two stale comments: the zero-liquidity guard covers compound only (the
  rebalance re-mint has none), and the spot-vs-fair gate does not apply to the
  rebalance re-mint. Drop the previewDepositForToken0 suggestion to deposit a
  single leg when fair leaves the range -- every shape reverts until a recenter.

Tests:
- Counter-tests for each liquidator fix, incl. a WBNB-loan market so the
  wrapped-native branch is exercised.
- previewDepositAmounts exact-match test; regression test pinning that deposits
  are closed while fair sits past tickUpper and reopen after a BOT recenter.
- _deposit helpers derive a non-zero minShares from previewDepositShares:
  min0/min1 floor the consumed amounts, not the entry price.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: razww

src/liquidator/V3Liquidator.sol

@@ -36,6 +36,7 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
   error SwapFailed();
   error NotAuthorized();
   error InvalidFundSource();
+  error ReceiverNotSelf();
 
   /* ──────────────────────────── constants ─────────────────────────── */
 
@@ -225,6 +226,7 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
   ///      tokens are never pushed to the vault; they stay here to be redeemed via redeemV3Shares.
   function setReflowBlacklist(address token, bool status) external onlyRole(MANAGER) {
     require(token != address(0), "zero address");
+    require(reflowBlacklist[token] != status, WhitelistSameStatus());
     reflowBlacklist[token] = status;
     emit ReflowBlacklistChanged(token, status);
   }
@@ -421,6 +423,7 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
     address receiver
   ) external nonReentrant onlyRole(BOT) returns (uint256 amount0, uint256 amount1) {
     require(v3Providers[v3Provider], NotWhitelisted());
+    require(fundSource == address(0) || receiver == address(this), ReceiverNotSelf());
     (amount0, amount1) = IV3Provider(v3Provider).redeemShares(shares, minAmt0, minAmt1, receiver);
     // When redeemed into this contract, reflow the legs to the vault (no-op when fundSource == 0).
     if (receiver == address(this)) {
@@ -510,6 +513,7 @@ contract V3Liquidator is ReentrancyGuardUpgradeable, UUPSUpgradeable, AccessCont
       // Snapshot before redeeming/swapping so profitability is judged on THIS liquidation's
       // delta, not masked by loanToken balance already sitting idle from prior liquidations.
       uint256 before = d.loanToken.balanceOf(address(this));
+      if (d.loanToken == wrappedNative) before += address(this).balance;
 
       // Redeem V3 shares → TOKEN0 + TOKEN1; the wrapped-native leg arrives as the native coin.
       (uint256 amount0, uint256 amount1) = IV3Provider(d.v3Provider).redeemShares(

src/provider/v3/SlisBNBV3DexAdapter.sol

@@ -53,7 +53,8 @@ contract SlisBNBV3DexAdapter is V3DexAdapter, ISlisBNBV3DexAdapter {
     (int24 initialTickLower, int24 initialTickUpper) = _initialTickRange(initialCenterRate);
     __V3DexAdapter_init(_admin, _manager, initialTickLower, initialTickUpper);
     lastCenterRate = initialCenterRate;
-    centerRateThresholdBps = INITIAL_RANGE_BPS;
+    // Minimal anti-churn floor only: 1 BPS
+    centerRateThresholdBps = 1;
   }
 
   /* ───────────────────────── hook overrides ───────────────────────── */

src/provider/v3/V3DexAdapter.sol

@@ -69,8 +69,8 @@ abstract contract V3DexAdapter is
   uint256 internal constant BPS = 10_000;
   /// @dev Denominator for `maxSwapLossBp` — parts-per-million (ppm).
   uint256 internal constant LOSS_DENOM = 1e6;
-  /// @dev Half-width of the rate-centered range for rate-implied pairs (±1%).
-  uint256 internal constant INITIAL_RANGE_BPS = 100;
+  /// @dev Half-width of the rate-centered range for rate-implied pairs (±0.5%).
+  uint256 internal constant INITIAL_RANGE_BPS = 50;
   /// @dev Fallback half-range (ticks) around spot for non-rate (TWAP) pairs.
   int24 internal constant FALLBACK_HALF_RANGE_TICKS = 500;
   /// @dev Fixed-point 2^128, the denominator of Uniswap V3 fee-growth (feeGrowthInside/Global) values.
@@ -110,12 +110,11 @@ abstract contract V3DexAdapter is
   ///      this slippage on the converted leg. Default 50_000 = 5%.
   uint256 public maxSwapLossBp;
 
-  /// @dev Max allowed |pool spot − fair| price deviation (bps of price) for adding liquidity at the pool
-  ///      spot: the (BOT-gated) compound and the rebalance re-mint both call increaseLiquidity/mint at the
-  ///      pool spot, so a flash-loan that skews spot could make the vault add liquidity at a manipulated
-  ///      price and get sandwiched on the attacker's back-swap. fairSqrtPriceX96
-  ///      is rate-anchored (flash-loan-immune for the LST pairs), so gating spot against it neutralises
-  ///      that vector. 0 disables the gate. Default INITIAL_RANGE_BPS (1%).
+  /// @dev Max allowed |pool spot − fair| price deviation (bps) for adding liquidity at the pool spot.
+  ///      Gates the compound path: fairSqrtPriceX96 is rate-anchored, so a flash-loan skew cannot make
+  ///      compound add at a manipulated price and get sandwiched on the back-swap. The rebalance re-mint
+  ///      has no fair gate — only the BOT's targetSqrtPriceX96 assertion (same tolerance), skipped at
+  ///      target 0, so pass a non-zero target in production. 0 disables. Default INITIAL_RANGE_BPS (0.5%).
   uint256 public maxSpotDeviationBps;
 
   /// @dev Max |live center rate − BOT expectedCenterRate| deviation on rebalance (BPS; 0 = off). Guards
@@ -230,7 +229,7 @@ abstract contract V3DexAdapter is
     maxSwapLossBp = 50_000; // 5% (ppm) — per-swap rate-anchored loss cap
     emit MaxSwapLossBpChanged(maxSwapLossBp);
 
-    maxSpotDeviationBps = INITIAL_RANGE_BPS; // 1% — spot-vs-fair gate for adding liquidity at pool spot
+    maxSpotDeviationBps = INITIAL_RANGE_BPS; // 0.5% — spot-vs-fair gate for adding liquidity at pool spot
     emit MaxSpotDeviationBpsChanged(maxSpotDeviationBps);
   }
 
@@ -746,11 +745,10 @@ abstract contract V3DexAdapter is
       return;
     }
 
-    // One-sided inventory relative to the active range yields zero addable liquidity, which would
-    // revert inside pool.mint (require(amount > 0)). Hold everything as idle and skip this round
-    // instead of reverting, so a BOT compound / rebalance is never bricked by a single-sided balance.
-    // The idle is deployed on a later compound once the opposite leg arrives or a rebalance recenters
-    // the range.
+    // One-sided inventory yields zero addable liquidity, which would revert inside pool.mint
+    // (require(amount > 0)). Park it as idle instead; a later compound or rebalance deploys it.
+    // Compound only — the rebalance re-mint has no such guard, so an empty-swapData recenter on
+    // one-sided inventory reverts bare out of pool.mint; pass swapData or a non-zero minLiquidity.
     uint128 addable = LiquidityAmounts.getLiquidityForAmounts(
       spotSqrtPriceX96(),
       TickMath.getSqrtRatioAtTick(tickLower),

src/provider/v3/V3Provider.sol

@@ -488,8 +488,9 @@ abstract contract V3Provider is
       uint256 f1 = (amount1Desired * WAD) / t1;
       frac = f0 < f1 ? f0 : f1;
     }
-    amount0 = (t0 * frac) / WAD;
-    amount1 = (t1 * frac) / WAD;
+    // Round UP, matching _quoteDeposit: the preview must report exactly what deposit() will consume.
+    amount0 = (t0 * frac + WAD - 1) / WAD;
+    amount1 = (t1 * frac + WAD - 1) / WAD;
   }
 
   /// @notice Preview the shares a deposit would mint — the exact min(fair, spot) credit deposit() uses.
@@ -516,9 +517,9 @@ abstract contract V3Provider is
 
   /// @notice Given a desired token0 amount, the token1 amount that pairs with it at the current fair
   ///         composition ratio, so a subsequent deposit consumes both legs fully (minimal refund).
-  /// @dev    amount1 = amount0 * T1 / T0, where (T0, T1) = getFairComposition(). Reverts if the fair
-  ///         composition has no token0 leg (in that one-sided case deposit token1 only). For the first
-  ///         deposit (no position yet) use previewDepositAmounts, which previews the spot mint instead.
+  /// @dev    amount1 = amount0 * T1 / T0, where (T0, T1) = getFairComposition(). Reverts once fair has
+  ///         drifted past tickUpper (no token0 leg); deposits are then closed in every shape until the
+  ///         BOT recenters. Symmetric below tickLower. First deposit: use previewDepositAmounts.
   function previewDepositForToken0(uint256 amount0) external view returns (uint256 amount1) {
     (uint256 t0, uint256 t1) = getFairComposition();
     if (t0 == 0) revert ZeroAmounts();

src/provider/v3/WbETHV3DexAdapter.sol

@@ -64,8 +64,8 @@ contract WbETHV3DexAdapter is V3DexAdapter {
     __V3DexAdapter_init(_admin, _manager, initialTickLower, initialTickUpper);
 
     lastCenterRate = initialCenterRate;
-    centerRateThresholdBps = INITIAL_RANGE_BPS;
-    maxTwapDeviationBps = INITIAL_RANGE_BPS; // default valuation clamp band = ±range width (±1%)
+    centerRateThresholdBps = 1;
+    maxTwapDeviationBps = INITIAL_RANGE_BPS; // default valuation clamp band = ±range width (±0.5%)
     emit MaxTwapDeviationChanged(INITIAL_RANGE_BPS);
   }
 

src/provider/v3/WstETHV3DexAdapter.sol

@@ -64,8 +64,8 @@ contract WstETHV3DexAdapter is V3DexAdapter {
     __V3DexAdapter_init(_admin, _manager, initialTickLower, initialTickUpper);
 
     lastCenterRate = initialCenterRate;
-    centerRateThresholdBps = INITIAL_RANGE_BPS;
-    maxTwapDeviationBps = INITIAL_RANGE_BPS; // default valuation clamp band = ±range width (±1%)
+    centerRateThresholdBps = 1;
+    maxTwapDeviationBps = INITIAL_RANGE_BPS; // default valuation clamp band = ±range width (±0.5%)
     emit MaxTwapDeviationChanged(INITIAL_RANGE_BPS);
   }
 

test/liquidator/V3Liquidator.t.sol

@@ -638,6 +638,73 @@ contract V3LiquidatorTest is Test {
     liquidator.flashLiquidate(Id.unwrap(marketId), user, shares, params);
   }
 
+  /// @dev Native analogue of the pre-funded-reserves test. When loanToken IS the wrapped-native, the
+  ///      profit check wraps the WHOLE native balance, so stray native held beforehand (an earlier
+  ///      redemption's unsold surplus, an un-reflowed redeemV3Shares, or a donation via receive()) would
+  ///      read as fresh profit and let a real shortfall pass. The snapshot must count it.
+  function test_flashLiquidate_strayNativeNotCountedAsProfit() public {
+    // WBNB-loan market so the wrapped-native branch of the profit check is taken.
+    MarketParams memory wbnbMp = MarketParams({
+      loanToken: WBNB,
+      collateralToken: address(provider),
+      oracle: address(providerOracle),
+      irm: IRM,
+      lltv: LLTV
+    });
+    Id wbnbId = wbnbMp.id();
+    vm.prank(OPERATOR);
+    moolah.createMarket(wbnbMp);
+    vm.prank(MANAGER_ADDR);
+    moolah.setProvider(wbnbId, address(provider), true);
+    vm.prank(manager);
+    liquidator.setMarketWhitelist(Id.unwrap(wbnbId), true);
+    vm.prank(manager);
+    liquidator.setTokenWhitelist(WBNB, true);
+
+    // Lender liquidity.
+    address lender = makeAddr("wbnbLender");
+    deal(WBNB, lender, 1_000 ether);
+    vm.startPrank(lender);
+    IERC20(WBNB).approve(address(moolah), type(uint256).max);
+    moolah.supply(wbnbMp, 500 ether, 0, lender, "");
+    vm.stopPrank();
+
+    // Collateral + borrow, then make it liquidatable with repaidAssets > 0.
+    (uint256 shares, , ) = _deposit(user, 10 ether, 10 ether);
+    vm.prank(user);
+    provider.withdrawShares(marketParams, shares, user, user);
+    vm.prank(user);
+    provider.supplyShares(wbnbMp, shares, user);
+    (, , uint128 col) = moolah.position(wbnbId, user);
+    uint256 borrowed = (uint256(col) * providerOracle.peek(address(provider)) * 60) / (providerOracle.peek(WBNB) * 100);
+    vm.prank(user);
+    moolah.borrow(wbnbMp, borrowed, 0, user, user);
+    _makeUnhealthyPartial(5_000);
+
+    // Stray native from prior activity — on its own it would cover the repayment.
+    vm.deal(address(liquidator), 100 ether);
+
+    // Both legs yield zero WBNB: THIS liquidation produces nothing.
+    bytes memory swap0Data = abi.encodeWithSelector(mockSwap.swap.selector, SLISBNB, WBNB, uint256(0), uint256(0));
+
+    V3Liquidator.FlashLiquidateParams memory params = V3Liquidator.FlashLiquidateParams({
+      v3Provider: address(provider),
+      minToken0Amt: 0,
+      minToken1Amt: 0,
+      redeemShares: true,
+      token0Pair: address(mockSwap),
+      token0Spender: address(0),
+      token1Pair: address(0), // token1 IS the loan token (WBNB) — no swap
+      token1Spender: address(0),
+      swapToken0Data: swap0Data,
+      swapToken1Data: ""
+    });
+
+    vm.prank(bot);
+    vm.expectRevert(V3Liquidator.NoProfit.selector);
+    liquidator.flashLiquidate(Id.unwrap(wbnbId), user, shares, params);
+  }
+
   function test_flashLiquidate_revertsIfMarketNotWhitelisted() public {
     vm.prank(manager);
     liquidator.setMarketWhitelist(Id.unwrap(marketId), false);
@@ -716,6 +783,55 @@ contract V3LiquidatorTest is Test {
     liquidator.redeemV3Shares(address(provider), 1, 0, 0, address(liquidator));
   }
 
+  /// @dev With a shared pool configured, an external receiver would bypass the reflow accounting, so it
+  ///      is rejected — vault-funded redemptions must land here and flow back through _reflow.
+  function test_redeemV3Shares_revertsOnExternalReceiverWithFundSource() public {
+    // Hold real seized shares, so without the guard this redeem would SUCCEED and pay the external
+    // address — the guard is what stops it, not a lack of balance.
+    (uint256 shares, , ) = _deposit(user, 10 ether, 10 ether);
+    _borrowAgainstCollateral(user);
+    _makeUnhealthy();
+    deal(LISUSD, address(liquidator), 1_000 ether);
+    vm.prank(bot);
+    liquidator.liquidate(Id.unwrap(marketId), user, shares, 0);
+    uint256 held = provider.balanceOf(address(liquidator));
+    assertGt(held, 0, "setup: liquidator holds shares");
+
+    LiquidationVault vault = _deployVault(true);
+    vm.prank(manager);
+    liquidator.setFundSource(address(vault));
+
+    vm.prank(bot);
+    vm.expectRevert(V3Liquidator.ReceiverNotSelf.selector);
+    liquidator.redeemV3Shares(address(provider), held, 0, 0, makeAddr("externalReceiver"));
+
+    // Same call into this contract still works.
+    vm.prank(bot);
+    liquidator.redeemV3Shares(address(provider), held, 0, 0, address(liquidator));
+    assertEq(provider.balanceOf(address(liquidator)), 0, "shares redeemed to self");
+  }
+
+  /// @dev Legacy (no shared pool): an external receiver stays allowed — the guard is scoped to fundSource.
+  function test_redeemV3Shares_externalReceiverAllowedWithoutFundSource() public {
+    assertEq(liquidator.fundSource(), address(0), "no fund source by default");
+
+    (uint256 shares, , ) = _deposit(user, 10 ether, 10 ether);
+    _borrowAgainstCollateral(user);
+    _makeUnhealthy();
+    deal(LISUSD, address(liquidator), 1_000 ether);
+    vm.prank(bot);
+    liquidator.liquidate(Id.unwrap(marketId), user, shares, 0);
+
+    uint256 held = provider.balanceOf(address(liquidator));
+    address receiver = makeAddr("externalReceiver");
+    uint256 before = IERC20(SLISBNB).balanceOf(receiver);
+
+    vm.prank(bot);
+    (uint256 out0, ) = liquidator.redeemV3Shares(address(provider), held, 0, 0, receiver);
+
+    assertEq(IERC20(SLISBNB).balanceOf(receiver) - before, out0, "external receiver paid");
+  }
+
   /* ─────────────────── sell token ─────────────────────────────────── */
 
   function test_sellToken_erc20_swapsAndClearsAllowance() public {

test/provider/SlisBNBV3Provider.t.sol

@@ -300,10 +300,13 @@ contract SlisBNBV3ProviderTest is Test {
     (, uint256 exp0, uint256 exp1) = provider.previewDepositAmounts(amount0, amount1);
     uint256 min0 = (exp0 * 999) / 1000;
     uint256 min1 = (exp1 * 999) / 1000;
+    // min0/min1 floor the CONSUMED amounts, not the entry price; minShares is the only guard against a
+    // bad price, so mirror production and never pass 0.
+    uint256 minShares = (provider.previewDepositShares(amount0, amount1) * 999) / 1000;
     vm.startPrank(_user);
     IERC20(SLISBNB).approve(address(provider), amount0);
     IERC20(WBNB).approve(address(provider), amount1);
-    (shares, used0, used1) = provider.deposit(marketParams, amount0, amount1, min0, min1, 0, _user);
+    (shares, used0, used1) = provider.deposit(marketParams, amount0, amount1, min0, min1, minShares, _user);
     vm.stopPrank();
   }
 
@@ -792,6 +795,19 @@ contract SlisBNBV3ProviderTest is Test {
     assertApproxEqAbs(used1, exp1, 1, "used1 should match preview within 1 wei");
   }
 
+  /// @dev Subsequent-deposit branch (supply > 0): the preview must equal what deposit() consumes to the
+  ///      wei. Both round the fair composition UP, so a floor-rounded preview would under-report by 1 wei.
+  function test_previewDeposit_amountsMatchActual_subsequentDeposit() public {
+    _deposit(user, 100 ether, 100 ether); // seed so the frac branch is taken
+
+    (uint128 liquidity, uint256 exp0, uint256 exp1) = provider.previewDepositAmounts(10 ether, 10 ether);
+    assertEq(liquidity, 0, "subsequent deposit parks to idle, mints no liquidity");
+
+    (, uint256 used0, uint256 used1) = _depositWithMin(user2, 10 ether, 10 ether, 0, 0);
+    assertEq(used0, exp0, "used0 == preview exactly");
+    assertEq(used1, exp1, "used1 == preview exactly");
+  }
+
   function test_previewDeposit_derivedMinAmounts_succeed() public {
     uint256 amount0 = 10 ether;
     uint256 amount1 = 10 ether;
@@ -2455,7 +2471,7 @@ contract SlisBNBV3ProviderTest is Test {
   /* ───────────── Spot-vs-fair gate when adding liquidity at pool spot ───────────── */
 
   function test_spotDeviationGate_defaults() public view {
-    assertEq(adapter.maxSpotDeviationBps(), 100, "default spot-deviation gate = 1%");
+    assertEq(adapter.maxSpotDeviationBps(), 50, "default spot-deviation gate = 0.5%");
   }
 
   function test_setMaxSpotDeviationBps_accessAndCaps() public {