Cowrie Research

lp-collateral-weakest-leg-unwind-and-same-window-quarantine

16 min read

LP Collateral Weakest-Leg Unwind and Same-Window Quarantine

  • Name: LP collateral weakest-leg unwind and same-window quarantine
  • Category: collateral-risk reference / LP-collateral checklist / reserve-state distrust note
  • Summary: Protocols routinely talk themselves into accepting LP tokens by narrating diversification, fee income, or anchor-asset backing. The balance-sheet question is harsher: what does this receipt token actually unwind into after the attacker stops cooperating, and how quickly is the protocol willing to honor a freshly printed LP mark as borrowing power? In concentrated-liquidity systems the same question applies to pending fee receivables and other pre-realization value states: if the protocol lends against fees as though they were already durable executable liquidity, it is still over-crediting a paper LP mark. This note exists to keep those disciplines fused. Healthy systems haircut LP collateral to the weakest executable exit path, separate pending fee state from money-good principal liquidity, and keep fresh reserve-shaped valuation from becoming same-window debt authority.
  • Why this note exists:
    • Many LP-token incidents are not just the oracle was manipulable. They are the protocol honored a wrapper-shaped paper NAV that could not be unwound at the size it was willing to lend against.
    • LP collateral wants two separate distrust boundaries: one for what the LP is really worth at exit, and another for when a fresh LP mark is allowed to create debt or liquidation authority.
    • Concentrated-liquidity lending adds a third recurring confusion: pending fees and fee receivables are not automatically equivalent to currently executable principal liquidity. If the protocol lends against uncollected fees before proving how reinvestment, rebalancing, or unwind will realize them, it is still over-crediting an LP-shaped paper mark.
    • Cheese Bank, Warp Finance, Nereus, Inverse, Market.xyz, and Impermax V3 all preserve the same reusable lesson: an LP receipt is only as safe as the weakest constituent market, the timing of the state read, the path by which paper value turns into executable liquidity, and the downstream policy that honors it.

What this note means by weakest-leg unwind and same-window quarantine

  • Weakest-leg unwind means the protocol values LP collateral by asking which constituent asset, redemption route, reserve vector, or constituent-rate dependency becomes fragile first when the protocol actually needs to exit size.
  • Same-window quarantine means a freshly observed LP valuation does not instantly become full borrowing power, liquidation truth, or recursive leverage authority in the same block or same short manipulation window.
  • The design goal is not never list LP collateral. It is do not let a receipt token inherit more solvency authority than its weakest component can really support under hostile execution.

Three LP-collateral promotions reviewers should not collapse

  1. Some reserve-shaped, fee-shaped, or wrapper-shaped state exists locally

    • The pool has reserves, a virtual price, a cached child rate, pending fees, or a wrapper exchange rate that returns a number.
    • This is only a local state-existence fact. It does not yet prove executable unwind value.

  2. The protocol publishes one canonical LP collateral mark from that state

    • A pricing helper, collateral engine, or wrapper reader promotes the local state into one official this LP is worth X answer.
    • This is a stronger step than mere readability because the system is now choosing one reserve / wrapper interpretation as collateral truth.

  3. Downstream debt, liquidation, or recursive routes are allowed to spend against that mark

    • Borrow limits, liquidation checks, recursive loops, or bad-debt paths already honor the published LP mark as money-good authority.
    • This is the decisive promotion, because a manipulable or only-paper LP state becomes dangerous when deeper reserves and settlement paths are already willing to trust it.

A lot of LP-collateral failures are really mistakes about collapsing those promotions into one vague the LP has a price moment. Healthy designs keep local pool state exists, the protocol published one collateral meaning for it, and that meaning may now mint debt or force liquidation visibly separate.

The main downstream-solvency controls

1. Haircut to executable unwind, not paper NAV

  • Reserve-derived LP value is not enough on its own.
  • The protocol needs a view of what the LP can actually be redeemed or sold for once the manipulator stops supporting the distorted reserve state.
  • If one leg is thin, protocol-native, reflexive, or wrapper-dependent, the haircut should be set by that weak leg rather than by the prettier anchor side.

2. Treat the anchor side as a ceiling, not a proof of safety

  • Many LP valuations quietly trust 2 * anchor reserve / totalSupply or a close cousin.
  • That can be useful for rough monitoring, but it is not proof that the non-anchor side is liquid, redeemable, or semantically stable.
  • If the protocol cannot safely realize the full two-sided NAV at size, it should not lend as if it can.

3. Delay fresh LP marks before they mint debt

  • A protocol should be able to read an updated LP value before it lets users borrow heavily against it.
  • Same-block refresh, updateExchangeRate, valueOfAsset, reserve reads, virtual-price pulls, or parent-pool rate caches should not immediately unlock large debt.
  • This is the LP-specific version of the broader boundary in collateral-admission-lag-and-borrow-side-quarantine.

4. Separate wrapper readability from liquidation authority

  • Liquidation is especially dangerous when the LP mark depends on fresh reserve state, callback-window state, or nested-pool rate caches.
  • The protocol should be able to observe an LP valuation anomaly without instantly forcing liquidations or accepting the mark as healthy collateral truth.
  • This matters for both classic reserve pumping and read-only reentrancy variants where the dangerous mark only exists mid-transition.

5. Constrain recursive and correlated borrow paths

  • LP collateral is often most dangerous when it can immediately support borrowing of correlated assets, stablecoins, or additional exposure to the same underlying market structure.
  • Isolation mode, borrow-pair restrictions, lower caps, and explicit recursion suppression keep one printed LP mark from financing more exposure to itself.
  • If the weakest LP leg is the protocol’s own token, governance token, or a thin strategy receipt, the recursion boundary should be especially strict.

6. Separate pending-fee receivables from executable LP collateral

  • In concentrated-liquidity systems, uncollected fees, pending rewards, or reinvestable fee inventory should not automatically inherit the same collateral quality as already-deployed principal liquidity.
  • The protocol should prove what those fees become after reinvestment, rebalancing, or forced unwind at the manipulated tick, not merely what they looked like before realization.
  • If pending fees can support borrowing but reinvest or unwind immediately converts them into a much weaker one-sided position, the system is still lending against paper NAV. Impermax V3 is the clean reminder.

7. Bind constituent-rate trust narrowly in nested pools

  • For Balancer-style nested pools, Curve metapools, vault-wrapped LPs, and similar structures, the protocol should write down exactly which child-pool rate or wrapper exchange rate is being trusted.
  • Parent pools should not inherit full confidence in a child LP or BPT rate just because everything lives in the same broader AMM system.
  • Cached constituent rates deserve the same distrust as live reserve reads when they can be cheaply perturbed or observed mid-transition.

8. Localize LP collateral blast radius

  • LP listings should have smaller debt ceilings, asset-local pauses, and route-local emergency controls than blue-chip spot collateral.
  • One thin LP market should not be able to print protocol-wide bad debt against the deepest stablecoin reserves.
  • If the protocol cannot pause, de-recognize, or haircut one LP asset quickly, it still lacks a mature LP-collateral boundary.

What sound design looks like

  • Readable LP state is not yet collateral truth.
    • The protocol can observe reserves, virtual prices, pending fees, child-pool rates, or wrapper exchange rates without pretending those raw numbers already prove executable unwind value.
  • Published LP collateral truth is earned explicitly.
    • The weak constituent, exit path, redemption queue, wrapper semantics, and fee-realization path are analyzed before one official LP collateral mark is allowed to exist.
  • Fresh valuation and debt authority are separate events.
    • The system can publish or monitor an LP mark before it makes that mark borrowable or liquidatable truth.
  • Haircuts follow executable exits.
    • The collateral factor reflects what the protocol could actually unwind after manipulation, not what the reserve vector advertised at the attacker-chosen moment.
  • Nested abstraction does not erase fragility.
    • Vault shares, BPTs, metapool receipts, and pending-fee states still inherit the weakest upstream market, wrapper dependency, or realization path.
  • LP risk is localized.
    • The protocol can cap, isolate, or disable one LP collateral path without waiting for whole-system shutdown.
  • Recursive leverage stays closed while trust is being earned.
    • Freshly published LP marks do not immediately finance loops, correlated borrows, or downstream liquidation cascades.

Failure-prevention checklist

  • Separate three review questions in code and ops: what local LP or fee state exists, what exact canonical LP collateral mark may be published from it, and which downstream borrow / liquidation / recursion paths are allowed to trust that mark.
  • Write down the exact unwind story for the LP at the protocol’s target position size: redeem path, AMM depth, weakest constituent asset, wrapper dependencies, and expected post-manipulation exit price.
  • Set collateral factors from executable exit assumptions, not from full two-sided paper NAV or anchor-reserve shortcuts.
  • Default fresh LP marks to a narrower trust state: low debt ceiling, isolated mode, delayed borrowing enablement, or collateral factor near zero until the valuation path proves stable.
  • Treat pending fees, uncollected rewards, and other pre-realization LP-side value as a weaker state than executable principal liquidity. If collateral logic credits them at full strength, the protocol must prove how reinvestment or unwind preserves that value under hostile ticks and one-sided inventory.
  • Prevent same-block or same-short-window reserve moves from becoming immediate solvency truth. If a user can print the LP mark and consume it before mean reversion, the quarantine boundary is missing.
  • Gate liquidation separately from price publication for LP collateral whose valuation depends on reserve snapshots, virtual-price helpers, or nested-pool constituent rates.
  • Suppress recursive, correlated, and same-family borrowing while the LP path is fresh or thin. Do not let one LP wrapper finance more exposure to its own weakest leg.
  • Cap LP collateral per asset and per market bucket. A thin LP listing should not inherit the same debt ceiling or borrow pairs as spot blue chips.
  • Inventory every child-pool rate, wrapper exchange rate, or reserve helper that contributes to LP value. If a parent system cannot explain exactly which upstream state authors the mark, the abstraction is already too loose.
  • Add asset-local rollback controls: lower collateral factor, freeze new borrows, freeze liquidations, isolate the market, or fully de-recognize the LP without pausing unrelated assets.
  • Monitor for the signals that usually mean the LP boundary is being stress-tested: abrupt reserve shifts, rate-cache jumps, constituent-weight drift, cap exhaustion, same-block borrow spikes, and recursive position growth.

Audit prompts

  • What exact local state makes this LP look valuable: live reserves, a virtual price, pending fees, a cached child-pool rate, a wrapper exchange rate, or some mixture of them?
  • Which step publishes that local state as the protocol’s one canonical LP collateral mark, and which downstream borrow, liquidation, or recursion paths trust it immediately after publication?
  • Which constituent leg is actually weakest under hostile exit, and how much protocol debt is being underwritten as if that weakest leg were deep and stable?
  • Can a user both move the underlying reserve or constituent-rate state and make the protocol consume that move in the same transaction or same short window?
  • If the protocol had to liquidate or de-risk a real LP position of this size after the attacker unwinds, what executable exit price would it actually get?
  • Are liquidations, collateral-factor checks, and recursive borrow routes honoring the same fresh LP mark immediately, or is there a staged distrust boundary between observation and enforcement?
  • For nested pools, which child rate or wrapper path can poison the parent mark, and what independent sanity check prevents the parent from over-crediting it?
  • Would the exploit still work if the LP were haircut to weakest-leg unwind value or if fresh marks had to age before becoming borrowable? If not, the protocol is probably over-crediting paper NAV.
  • Who can list the LP, switch oracle helpers, loosen haircuts, or widen borrow pairs, and how are those governance actions reviewed as new balance-sheet authority rather than mere market configuration?
  • If this LP asset begins misbehaving, can operators isolate it faster than users can recycle the printed mark into stablecoin borrows or liquidations?
  • Where do monitors compare LP-local accounting against executable market exits, rather than only against other reserve-derived marks from the same AMM family?

Lessons that should already be standard

  • LP token is a packaging format, not a safety proof.
  • This pool returns a number, this number is our collateral truth, and this truth may now mint debt or trigger liquidation are three different claims.
  • The strongest-looking side of the pool does not rescue the weakest side from being the real collateral bottleneck.
  • Paper NAV is not solvency truth if the protocol cannot actually exit at that value after manipulation.
  • Same-window LP refresh is debt authorship. If the borrower can print the mark and immediately consume it, the valuation path is effectively user-written.
  • Liquidation against fresh LP marks is just as dangerous as borrowing against them. Forced sales and liquidations should not be the first consumers of half-trusted wrapper prices.
  • Nested pools and vault-wrapped LPs do not remove oracle risk; they often hide it one layer deeper.
  • Isolation mode, caps, delayed recognition, and asset-local rollback are not UX blemishes for LP collateral. They are what responsible LP collateral policy looks like.
  • If a protocol cannot explain how it would unwind the LP after the attacker stops cooperating, it should not be lending against the full displayed NAV.

Useful positive design shapes

1. Shadow-priced LP listing before full collateral admission

  • The protocol observes and publishes the LP valuation while keeping collateral factor near zero or borrowability tightly capped.
  • The useful habit is that the system learns how the LP behaves under normal and stressed conditions before users can scale debt against it.
  • This is the LP-specific companion to collateral-admission-lag-and-borrow-side-quarantine.

2. Weakest-leg haircut tables instead of one generic LP policy

  • Different LPs should not inherit the same haircut just because they are all Uniswap V2 LPs or BPTs.
  • A healthy policy writes down why one pool’s weakest leg deserves materially tighter treatment than another’s.
  • The reusable move is to let constituent fragility, not wrapper branding, set the collateral boundary.

3. Same-window quarantine for reserve-shaped state

  • Reserve changes, virtual-price moves, and child-rate updates can be observed immediately while borrowing and liquidations remain delayed, bounded, or isolated.
  • The point is to break the common exploit path where the attacker both authors and monetizes the mark before arbitrage or keepers can react.
  • This is the timing-side companion to delayed-snapshots-and-same-block-quarantine.

4. Nested-pool admission with explicit constituent-rate distrust

  • A protocol can list a wrapped LP or BPT only after naming the upstream child-pool rates and wrapper paths that can poison its mark.
  • The design win is not simply use a more sophisticated wrapper. It is keep abstraction boundaries explicit enough that one poisoned child rate does not silently become parent-collateral truth.

Negative exemplar cluster: what underdesigned LP collateral policy looks like

  • Cheese Bank — a thin CHEESE-ETH LP position was treated as if reserve-shaped NAV were good stablecoin collateral.
  • Warp Finance — underlying TWAPs did not save a pricing path that still honored live reserve composition as collateral truth.
  • Nereus — a small LP position became major borrow power because the protocol let the attacker publish and consume a fresh exchange-rate mark in one window.
  • Inverse — one wrapper layer of Yearn abstraction did not make the underlying Curve LP safe collateral.
  • Impermax V3 — concentrated-liquidity fee-receivable cousin where pending Uniswap V3 fees were honored as borrow-supporting collateral even though reinvest turned them into a much weaker one-sided position at the manipulated tick.
  • Market.xyz, Sentiment, and EraLend — callback-window and unfinished-state cousins showing that LP collateral can be over-credited even without a durable spot-price move.
  • Balancer Boosted Pools — the parent-pool version, where cached constituent BPT rates became pricing truth for a stronger balance sheet.

Red flags that usually mean the LP boundary is underdesigned

  • The anchor asset is blue-chip, so the LP is safe enough
  • The LP is diversified collateral without a weakest-leg unwind analysis
  • We use TWAPs for the underlying assets while collateral truth still depends on live reserve composition or cached constituent rates
  • The price is onchain and canonical used as if canonical publication proved executable exit value
  • We can just pause if something looks wrong when same-block borrowing or liquidation can already outrun the pause path
  • It's only an LP wrapper around a reputable protocol as if wrapper and nested-pool semantics were not additional failure surfaces

Design questions worth asking first

  • What is the weakest constituent or wrapper dependency inside this LP, and how does that set the real collateral boundary?
  • How much protocol debt can one fresh LP mark create before humans or automation can react?
  • Does the protocol know its executable unwind price at size, or only its paper reserve-derived NAV?
  • Can a borrower both author and consume the LP mark within one manipulation window?
  • Are liquidation and recursive borrow rails staged more cautiously than price publication?
  • If the LP’s weakest leg broke tomorrow, could the protocol isolate this one asset without spreading the damage across deeper reserves?

How this note complements the exploit corpus

  • Start here when the design question is how should a protocol decide what an LP receipt is worth as collateral and when that value may become borrowing power?
  • Pair with LP-token oracle mispricing when you need the recurring failure taxonomy for reserve-shaped LP valuation exploits.
  • Pair with collateral-admission-lag-and-borrow-side-quarantine when the sharper downstream question is the staged activation of fresh collateral value, not LP-specific weakest-leg analysis.
  • Pair with delayed-snapshots-and-same-block-quarantine when the key timing problem is same-block state consumption beyond LP collateral specifically.
  • Pair with safe-read-surface-discipline when the dangerous state read comes from unfinished callback-window state rather than ordinary spot reserve movement.
  • Pair with wrapper-semantic-price-revocation-and-collateral-derecognition when the upstream wrapper or constituent token has semantically ceased to deserve price recognition at all.
  • Drop into oracle manipulation when the protocol is really trusting a manipulable market print more generally rather than an LP-specific wrapper valuation path.
  • Drop into read-only reentrancy when the sharper lesson is unsettled callback-window state rather than weakest-leg LP economics.

Internal linkages

Control surface

Graph View

Backlinks