set-status-funded doesn-t verify btc-tx-id in the clarity code (uasu / dlc-manager)

[Rapha-btc]

I'd love to understand where the verification of the btc-tx-id is handled and how? @radicleart

also this function can only be called by the protocol-wallet-address which can be reset by the owner of uasu contract

[Rapha-btc]

Tested in clarinet console: dlc-manager-v1-1 and uasu-sbtc-loan-v2 as followed:

• dlc-manager-v1-1: deployer is contract owner of dlc-manager and can register uasu-sbtc-loan-v2
• uasu-sbtc-loan-v2: deployer can setup-loan for collateral amount u1500000000
• uasu-sbtc-loan-v2: deployer cannot borrow if err-dlc-not-funded (err u1009)
• dlc-manager-v1-1: set-status-funded: only protocol wallet can set-status-funded (err u101)
• uasu-sbtc-loan-v2: Borrow: cannot borrow if not owner of loan err-unauthorised (err u1005)
• uasu-sbtc-loan-v2: Borrow: can borrow up to vault-collateral
• uasu-sbtc-loan-v2: Borrow: err-borrow-limit-reached
• uasu-sbtc-loan-v2: Repay: err unautorised if not the owner (err 1005)
• uasu-sbtc-loan-v2: Repay: err-balance-negative (repaying more than vault-loan
• uasu-sbtc-loan-v2: Repay: repaying in full and verified vault-loan = u0
• uasu-sbtc-loan-v2: close-loan: can't close if not repaid in full err-not-repaid 1013
• uasu-sbtc-loan-v2: close-loan: can close when vault-loan = u0, getting nft burnt and outcome printed of u0

I'd love also to understand from there how they take outcome u0 and unlock DLC 100% to Alice @radicleart

[Rapha-btc]

• dlc-manager-v1-1: post-close can only be called by the protocol-wallet err-unauthorized (err u101)
• uasu-sbtc-loan-v2: post-close-dlc-handler -> problem: anyone can call this public function but it should be restricted to dlc-manager-v1-1 -> add this (asserts! (is-eq dlc-manager-address contract-caller) err-unauthorised) @radicleart
• uasu-sbtc-loan-v2: post-close: set-status is probably more logical to print new-status (rather than old) on line 169
• uasu-sbtc-loan-v2: attempt-liquidate: err-does-not-need-liquidation
• uasu-sbtc-loan-v2: attempt-liquidate: anyone can liquidate and if borrowed + fee > collateral, then u10000 outcome
• uasu-sbtc-loan-v2: anyone attempt-liquidate but loan < (collateral/liquidation ratio) -> (err u1007) err-does-not-need-liquidation. For example collateral 1 BTC and loan 70m Sats.
• uasu-sbtc-loan-v2: anyone attempt-liquidate is possible with the correct outcome from get-payout-ratio when borrowed-plus-liquidation < total-locked (random case of outcome u7857)
• uasu-sbtc-loan-v2: anyone attempting to close a second time and rightfully getting err-dlc-in-invalid-state-for-request since vault is not in funded or created but in status-closing
• uasu-sbtc-loan-v2: anyone can liquidate in the case of outcome u10000

[Rapha-btc]

Loan Ratio of 140% means that Collateral / Loan must be greater than 140%, else loan is eligible for liquidation

C/L >= LR then does-not-need-liquidation

if (<= C / L LR) then eligible for liquidation if (<= C LR * L) then eligible for liquidation

therefore on line 317 of uasu-sbtc-loan-v2 it's the other way around: (ok (>= loan-amount (/ (* collateral u10000) (get liquidation-ratio loan)))) for sBTC you can set this at u10500 rather than u14000 because it's not like borrowing dollar stablecoins @radicleart

[Rapha-btc]

• uasu-sbtc-loan-v2: setup-loan err-contract-call-failed -> advance chain tip and was resolved -> this message is opaque and we don't have access to the error messages from dlc-manager-v1-1 / create-dlc (was it because the uuid generated was identical?) -> is it possible to display or access these error messages? @radicleart
• uasu-sbtc-loan-v2: borrow: tried borrowing after it was liquidated and getting rightfully (err u1009) err-dlc-not-funded
• dlc-manager-v1-1: post-close after liquidation called by other than protocol-wallet err-unauthorized (err u101) rightfully
• dlc-manager-v1-1: post-close after liquidation called by protocol-wallet (ok true) and set to "liquidated"

[Rapha-btc]

I made 27 tests using clarinet console (https://github.com/Uasu-Finance/uasu-clar/issues/9) but got rid of the attestators in the setup-loan because I didn't know how to pass this in clarinet console:

TL;DR:

• [optional] on line 169 of uasu-sbtc-loan-v2, probably more logical to print new-status (rather than old): (print { loan-id: loan-id, uuid: (get dlc_uuid loan), status: new-status }) ;;

• [critical] on line 293 add the following: can only be called by dlc-manager-address (asserts! (is-eq dlc-manager-address contract-caller) err-unauthorised)

• [critical] on line 317 of uasu-sbtc-loan-v2 it's the other way around: (ok (>= loan-amount (/ (* collateral u10000) (get liquidation-ratio loan))))

• [unsure] when setup-loan using the same inputs, I sometimes get (err u1001) but unable to see the dlc-manager-v1-1 exact error, and is it because the same uuid cannot be created? @radicleart

[radicleart]

• post-close-dlc-handler

this is fine as is. anyone can call it because the user has already closed the loan - see check on status.

[radicleart]

therefore on line 317 of uasu-sbtc-loan-v2 it's the other way around:

trying to remove the possiblity of underflow here...

check-liquidation returns true if

(amount borrowed/collateral)*100 >= ratio

Do you agree with this ?

Then multiplying through by collateral

amount borrowed * 100 >= collateral * ratio

no danger of 0 rounding in the divisor. leavng as is in v2.