Cowrie Research

lp-exit-and-next-quote-balance-sheet-coherence

11 min read

LP Exit and Next-Quote Balance-Sheet Coherence

  • Name: LP exit and next-quote balance-sheet coherence
  • Category: pool-accounting reference / withdrawal-pricing design note / virtual-liability discipline
  • Summary: Some pool designs break not because swaps are wrong in isolation or because LP withdrawals are too generous in isolation, but because the two paths stop consulting the same post-settlement balance sheet. A burn path removes scarce reserves using one notion of value, then the next swap, bridge quote, or redemption path prices against a richer leftover liability object that the burn path failed to retire. This note exists to make the healthy-side target explicit: after any LP exit, there should be one canonical post-settlement state for real reserves, virtual liabilities, pending bridge obligations, fee state, and imbalance penalties, and every immediately following quote should consume that same state instead of a more optimistic sibling view.

Why this note exists

  • Several incidents are not captured well enough by bad AMM math or bad withdrawal math alone. The sharper failure is the exit path and the next quote disagreed about what value was still there.
  • Allbridge Core is the clean bridge-pool exemplar: a loss-making LP withdrawal removed too much real value relative to the internal liability it retired, then the next quote spent the leftover fiction.
  • This note is the positive-design companion when the exploit-side taxonomy already says virtual-balance withdrawal mismatch, state-publication authority failure, or donation/share-price manipulation, but the next question is what exact post-withdrawal accounting object should exits and quotes both have been forced to read?

What this note means by balance-sheet coherence

  • LP exit means any withdrawal, burn, unstake, redeem, liquidity-removal, bridge-pool exit, or helper path that removes scarce reserves or claimable backing from a shared pool.
  • Next quote means the very next swap, bridge, redemption, borrow-power calculation, collateral mark, or route price that consumes the pool’s post-exit state.
  • Balance-sheet coherence means both steps read the same canonical state transition for reserves, liabilities, fees, and pending obligations.
  • The design goal is not never let one action affect the next quote. The design goal is make sure the next quote reflects the same value destruction, liability retirement, and reserve migration the exit path just caused.

The main coherence requirements

1. One post-settlement accounting object

  • The protocol should be able to point to one state object that answers all of these questions after an exit:
    • how much real reserve remains
    • how much internal or virtual liability remains
    • what pending bridge or settlement obligations remain
    • what fees, penalties, or rebates were crystallized
    • what next quote is still economically honest
  • If different functions reconstruct those answers from different subsets of state, the system is already vulnerable to paying from inconsistent books.

2. Reserve removal and liability retirement must happen together

  • A withdrawal that removes scarce backing cannot leave behind the full internal liability that used to be backed by that reserve.
  • Burning LP shares, redemption receipts, or pool claims should retire the economically matching liability before any downstream price or quote path treats the leftover state as spendable truth.
  • Nominal 1:1 burn intuition is especially dangerous in single-sided pools, bridge pools, wrapper pools, and skewed states.

3. Quote consumers must read post-exit state, not reconstructed optimism

  • The next swap or bridge quote should consume the exact state that the exit path wrote, including imbalance penalties, reserve depletion, and liability retirement.
  • A common failure shape is exit path writes stressed state while quote path recomputes from a friendlier mark, cached ratio, or nominal virtual balance.
  • If the quote path can still see value the exit path was supposed to destroy, the protocol is paying twice.

4. Same-actor LP-to-swap sequencing is a first-class adversarial path

  • Designs should assume the same actor can add liquidity, skew the pool, withdraw at a loss, and immediately consume the resulting quote in one bundle.
  • A protocol that is only safe when LPs and swappers are socially distinct is underdesigned.
  • Loss-making setup legs are not a weird market pattern to ignore; they are often the clearest signal that exits and quotes disagree about value.

5. Pending obligations belong inside the same balance sheet

  • Bridge fills in flight, delayed settlements, owed redemptions, fee claims, or operator-managed reserve migrations are not off-path bookkeeping.
  • If an exit path ignores pending obligations but the next quote also ignores them differently, the protocol may spend against backing that is already committed elsewhere.
  • Healthy designs keep pending obligations explicit and subtractive before fresh quotes or exits are honored.

6. Publication and quotation should not outrun settlement

  • Even when an exit path writes the right state eventually, the system can still fail if a helper, cache, or quote path observes an earlier snapshot and publishes it as live authority.
  • Same-block, same-transaction, or same-bundle quote reuse deserves special scrutiny whenever exits materially reshape solvency.
  • If the protocol cannot guarantee same-state consumption, it should stage, clamp, or delay the next quote.

What sound design looks like

  • Every exit produces one canonical post-exit balance sheet. There is no separate withdrawal accounting view and pricing view once reserves moved.
  • Liabilities shrink when backing leaves. Virtual balances, synthetic credits, claimable reserves, or price-supporting accounting units are retired in the same transition that removes the scarce asset they were meant to represent.
  • Next quotes are reserve-bounded by construction. The next trade or redemption cannot reach a more optimistic state object than the exit path just wrote.
  • Pending obligations stay visible. Delayed bridge fills, reserve migrations, or queued redemptions are treated as already spoken-for value before new quotes consume the balance sheet.
  • Same-actor sequencing is assumed, not hand-waved away. The protocol remains coherent even when the entity creating imbalance is also the first entity allowed to trade against it.
  • When coherence is uncertain, authority narrows. The safe fallback is to clamp quotes, stage exits, slow publication, or route into degraded mode rather than letting one inconsistent snapshot spend real reserves.

Useful positive design shapes

1. One writer, many readers, one object

  • The protocol keeps one canonical reserve/liability state object and forces exit math, quote math, redemption math, and bridge routing to read from that same committed post-transition state.
  • This is the cleanest design answer to withdrawal path wrote one story; price path told another.

2. Exit-committed quote derivation

  • The quote path derives its numbers only from the exact balances, liabilities, and penalties committed by the exit transaction, not from pre-exit caches or nominal virtual balances.
  • If a quote cannot prove it is reading exit-committed state, it should not receive full reserve authority.

3. Liability-first reserve release discipline

  • Before scarce reserves leave, the protocol first computes the economically matching liability retirement and then bounds reserve release by that result.
  • This is especially valuable for single-sided pools, bridge pools, wrappers, and low-liquidity states where intuitive burn math often lies.

4. Same-window quarantine after large exits

  • If one exit can meaningfully reshape the usable balance sheet, the protocol can delay fresh quotes, cap their size, or narrow which routes may consume the new state until coherence checks pass.
  • This is not a substitute for coherent accounting, but it is a useful blast-radius limiter.

Failure-prevention checklist

  • Define one canonical post-settlement state object for every pool or wrapper surface: real reserves, virtual liabilities, pending obligations, fees, imbalance penalties, and any staged settlement state.
  • Force every LP burn, redeem, unstake, or withdrawal path to retire the economically matching liability before scarce reserves leave the system.
  • Make the next swap, bridge quote, redemption, borrow-power read, or collateral mark consume the exact same post-exit state object that the exit path wrote.
  • Eliminate cached, nominal, or helper-derived quote paths that can observe a friendlier balance sheet than the one withdrawals actually settled against.
  • Test same-actor sequences that deliberately lose money on the exit leg to improve the next quote. If those sequences ever profit, exits and quotes are not reading one coherent state.
  • Include pending bridge fills, delayed settlements, queued redemptions, operator rebalances, and fee claims in the post-exit balance sheet before new quotes are authorized.
  • Add state-commitment assertions: once an exit commits reserve depletion and liability retirement, no sibling path may quote as if the pre-exit state still existed.
  • Clamp, delay, or quarantine quotes after outsized exits when same-state consumption cannot be proven cheaply.
  • Monitor for impossible transitions: reserve drops without corresponding liability retirement, quote jumps immediately after large exits, or profitable loss-making withdrawal-plus-swap bundles.
  • Review routers, wrappers, bridge helpers, and pricing adapters as equal participants in the coherence boundary rather than as off-path convenience code.

Audit prompts

  • What exact state object do LP exits write, and what exact state object do next quotes read? Are they literally the same committed object?
  • If a withdrawal removes scarce reserves, where exactly is the matching liability retirement computed and persisted before the next quote becomes live?
  • Can the same actor worsen imbalance through an apparently irrational exit and then recover that loss through the next quote, redemption, or bridge route?
  • Which helpers, caches, wrappers, or pricing adapters can still see a more optimistic balance sheet than the one the exit path settled?
  • Are pending bridge fills, reserve migrations, queued withdrawals, fee claims, or delayed settlements already deducted before exits and quotes consume the state?
  • If an exit changes the pool drastically, what prevents a same-block or same-bundle quote from spending the old state one last time?
  • Does the protocol ever compute withdrawal value from one notion of backing and quote value from another, such as nominal virtual balances versus current backed value?
  • What alert would fire if reserve depletion and liability retirement diverged materially after a large exit?

Lessons that should already be standard

  • An LP exit and the next quote are one security surface when they consume the same pool.
  • If reserves left but liabilities did not shrink proportionally, the next quote is already suspect.
  • A loss-making withdrawal can be the first leg of a profitable exploit, not evidence that the system is safe.
  • Virtual balances are only harmless abstractions until a quote, redemption, or bridge route spends against them.
  • Cached or helper-derived pricing is dangerous whenever it can outrun balance-sheet settlement.
  • Pending obligations are part of solvency now, not ops cleanup later.
  • The protocol is paying twice whenever one path destroys value and another path still prices as if that value survived.

Negative exemplar cluster

  • Allbridge Core is the clean bridge-pool exemplar: a large LP withdrawal removed too much real value relative to retired vUSD, and the next quote monetized the leftover fiction.
  • Spartan Protocol is the ambient-balance cousin: liquidity accounting and the next pricing state drifted because the pool treated raw balances as already-recognized reserve truth.
  • OneRing is the valuation cousin: local reserve-state publication and downstream redemption authority collapsed into one step.

How to use this note with the exploit corpus

Internal linkages

Control surface

Graph View

Backlinks