fix(liquidation): fix repaid assets rounding

[Rubilmax]

• Fixes https://cantina.xyz/ai/d86b7f95-e574-4092-8ea2-78dcac2f54f1/findings/54bbc294-2d22-4979-8cda-4db8415474f6

[Rubilmax]

@adhusson wrote:

Agree with rounding down seized assets since the liquidate parameters are controlled by the liquidator.

The test testLiquidateSharesInputNoBadDebtRealized is failing because the liquidator should now expect fewer assets seized.

Worth noting that the POC on cantina has a setup with 300 borrowed, 400 collateral. It runs for 399 iterations and consumes 11M gas before the the borrower runs out of collateral. Keeping the LTV constant, both the iterations and the gas necessary to empty the borrower's collateral go up linearly with the borrow1. For instance with 40k collateral at the start it takes 39999 iterations and 1.13B gas to steal all the collateral. You can't steal more than 1.15/price of collateral at a time (edit: added correct stealable amount).

Footnotes

1. using manual memory management to avoid quadratic memory costs ↩

You can't steal more than 1.15/price of collateral at a time

Can you explain how you get to that number pls?

Seized assets are [ceil|floor](repaidSharesToAssets) * liquidationIncentiveFactor / collateralPrice so you steal at most MAX_LIQUIDATION_INCENTIVE_FACTOR/price.

[QGarchery]

Given this new issue, I'm putting into question the importance to have the shares as input to the liquidate function. Removing this input is another (albeit radical) solution to this issue

[Rubilmax]

The only issue I have is that seizedAssets input converted into repaidShares can be greater than borrowShares thus overflow, so a liquidator who wants to liquidate everything would have to input either collateral or collateral - 1 (whereas today they have to either input seizedAssets = collateral or repaidShares = borrowShares)

[Rubilmax]

Besides, it seems weird to remove the granularity of repaid shares to liquidate, because a liquidation is like a repay + withdraw collateral

[QGarchery]

Besides, it seems weird to remove the granularity of repaid shares to liquidate, because a liquidation is like a repay + withdraw collateral

By the same logic it should also expose a liquidate repaidAssets entrypoint. Ideally we would have a use case in mind to enable another entrypoint

The only issue I have is that seizedAssets input converted into repaidShares can be greater than borrowShares thus overflow, so a liquidator who wants to liquidate everything would have to input either collateral or collateral - 1

I think it's even more general, and there are situations where the collateral seized would be less than the full collateral. Typically this is in LTV range [LLTV, 1/LIF]. The choice to have the repaid shares entrypoint was to facilitate full liquidations in those cases, and the choice was made against making bad debt realization more of a natural choice. I'm still not fully convinced by the argument in favor, and I also feel like now the code is less clear because of it

[Rubilmax]

Replaced by #638