[POC]: example if we remove share to 0 if only lockup shares are left

.forge-snapshots/BinHookTest#testBurnSucceedsWithHook.snap

@@ -1 +1 @@
-178130
+179611

.forge-snapshots/BinHookTest#testMintSucceedsWithHook.snap

@@ -1 +1 @@
-311254
+311574

.forge-snapshots/BinMintBurnFeeHookTest#test_Burn.snap

@@ -1 +1 @@
-170145
+167865

.forge-snapshots/BinMintBurnFeeHookTest#test_Mint.snap

@@ -1 +1 @@
-410336
+410526

.forge-snapshots/BinPoolManagerBytecodeSize.snap

@@ -1 +1 @@
-23287
+23766

.forge-snapshots/BinPoolManagerTest#testBurnNativeCurrency.snap

@@ -1 +1 @@
-133892
+135054

.forge-snapshots/BinPoolManagerTest#testGasBurnHalfBin.snap

@@ -1 +1 @@
-142717
+143286

.forge-snapshots/BinPoolManagerTest#testGasBurnNineBins.snap

@@ -1 +1 @@
-289683
+297444

.forge-snapshots/BinPoolManagerTest#testGasBurnOneBin.snap

@@ -1 +1 @@
-127065
+128227

.forge-snapshots/BinPoolManagerTest#testGasMintNneBins-1.snap

@@ -1 +1 @@
-968475
+971323

.forge-snapshots/BinPoolManagerTest#testGasMintNneBins-2.snap

@@ -1 +1 @@
-327787
+330068

.forge-snapshots/BinPoolManagerTest#testGasMintOneBin-1.snap

@@ -1 +1 @@
-337511
+337831

.forge-snapshots/BinPoolManagerTest#testGasMintOneBin-2.snap

@@ -1 +1 @@
-140062
+140319

.forge-snapshots/BinPoolManagerTest#testMintNativeCurrency.snap

@@ -1 +1 @@
-304550
+304870

src/pool-bin/BinPoolManager.sol

@@ -239,7 +239,8 @@ contract BinPoolManager is IBinPoolManager, ProtocolFees, Extsload {
 
         uint256[] memory binIds;
         bytes32[] memory amountRemoved;
-        (delta, binIds, amountRemoved) = pool.burn(
+        bytes32 feeAmountToProtocol;
+        (delta, binIds, amountRemoved, feeAmountToProtocol) = pool.burn(
             BinPool.BurnParams({
                 from: msg.sender,
                 ids: params.ids,
@@ -248,6 +249,13 @@ contract BinPoolManager is IBinPoolManager, ProtocolFees, Extsload {
             })
         );
 
+        unchecked {
+            if (feeAmountToProtocol > 0) {
+                protocolFeesAccrued[key.currency0] += feeAmountToProtocol.decodeX();
+                protocolFeesAccrued[key.currency1] += feeAmountToProtocol.decodeY();
+            }
+        }
+
         /// @notice Make sure the first event is noted, so that later events from afterHook won't get mixed up with this one
         emit Burn(id, msg.sender, binIds, params.salt, amountRemoved);
 

src/pool-bin/interfaces/IBinPoolManager.sol

@@ -170,6 +170,8 @@ interface IBinPoolManager is IProtocolFees, IPoolManager, IExtsload {
     function initialize(PoolKey memory key, uint24 activeId) external;
 
     /// @notice Add liquidity to a pool
+    /// @dev For the first liquidity added to a bin, the share minted would be slightly lessser (1e3 lesser) to prevent
+    /// share inflation attack.
     /// @return delta BalanceDelta, will be negative indicating how much total amt0 and amt1 liquidity added
     /// @return mintArray Liquidity added in which ids, how much amt0, amt1 and how much liquidity added
     function mint(PoolKey memory key, IBinPoolManager.MintParams calldata params, bytes calldata hookData)

src/pool-bin/libraries/BinPool.sol

@@ -66,6 +66,10 @@ library BinPool {
         mapping(bytes32 => bytes32) level2;
     }
 
+    /// @dev when a bin has supply for the first time, 1e3 share will be locked up
+    /// this is to prevent share inflation attack on BinPool type
+    uint256 constant MINIMUM_SHARE = 1e3;
+
     function initialize(State storage self, uint24 activeId, uint24 protocolFee, uint24 lpFee) internal {
         /// An initialized pool will not have activeId: 0
         if (self.slot0.activeId() != 0) revert PoolAlreadyInitialized();
@@ -294,7 +298,7 @@ library BinPool {
     /// @return result the delta of the token balance of the pool
     function burn(State storage self, BurnParams memory params)
         internal
-        returns (BalanceDelta result, uint256[] memory ids, bytes32[] memory amounts)
+        returns (BalanceDelta result, uint256[] memory ids, bytes32[] memory amounts, bytes32 feeAmountToProtocol)
     {
         ids = params.ids;
         uint256 idsLength = ids.length;
@@ -313,15 +317,21 @@ library BinPool {
             bytes32 binReserves = self.reserveOfBin[id];
             uint256 supply = self.shareOfBin[id];
 
-            _subShare(self, params.from, id, params.salt, amountToBurn);
+            amountToBurn = _subShare(self, params.from, id, params.salt, amountToBurn);
 
             bytes32 amountsOutFromBin = binReserves.getAmountOutOfBin(amountToBurn, supply);
+            if (supply == amountToBurn) feeAmountToProtocol = binReserves.getAmountOutOfBin(MINIMUM_SHARE, supply);
 
             if (amountsOutFromBin == 0) revert BinPool__ZeroAmountsOut(id);
 
             binReserves = binReserves.sub(amountsOutFromBin);
 
-            if (supply == amountToBurn) _removeBinIdToTree(self, id);
+            if (supply == amountToBurn) {
+                _removeBinIdToTree(self, id);
+
+                /// @notice withdraw all the liquidity from the bin, the locked up share will be withdrawn as protocol fee
+                amountsOutFromBin.sub(feeAmountToProtocol);
+            }
 
             self.reserveOfBin[id] = binReserves;
             amounts[i] = amountsOutFromBin;
@@ -385,12 +395,12 @@ library BinPool {
             amountsLeft = amountsLeft.sub(amountsIn);
             feeAmountToProtocol = feeAmountToProtocol.add(binFeeAmt);
 
+            shares = _addShare(self, params.to, id, params.salt, shares);
+
             arrays.ids[i] = id;
             arrays.amounts[i] = amountsInToBin;
             arrays.liquidityMinted[i] = shares;
 
-            _addShare(self, params.to, id, params.salt, shares);
-
             compositionFeeAmount = compositionFeeAmount.add(binCompositionFee);
 
             unchecked {
@@ -461,14 +471,33 @@ library BinPool {
     }
 
     /// @notice Subtract share from user's position and update total share supply of bin
-    function _subShare(State storage self, address owner, uint24 binId, bytes32 salt, uint256 shares) internal {
+    function _subShare(State storage self, address owner, uint24 binId, bytes32 salt, uint256 shares)
+        internal
+        returns (uint256 amountsToBurn)
+    {
         self.positions.get(owner, binId, salt).subShare(shares);
-        self.shareOfBin[binId] -= shares;
+        amountsToBurn = shares;
+        if (self.shareOfBin[binId] - shares == MINIMUM_SHARE) {
+            amountsToBurn += MINIMUM_SHARE;
+        }
+        self.shareOfBin[binId] -= amountsToBurn;
     }
 
     /// @notice Add share to user's position and update total share supply of bin
-    function _addShare(State storage self, address owner, uint24 binId, bytes32 salt, uint256 shares) internal {
-        self.positions.get(owner, binId, salt).addShare(shares);
+    /// @dev if bin is empty, deduct MINIMUM_SHARE from shares
+    /// @return userShareAdded The amount of share added to user's position
+    function _addShare(State storage self, address owner, uint24 binId, bytes32 salt, uint256 shares)
+        internal
+        returns (uint256 userShareAdded)
+    {
+        userShareAdded = shares;
+        if (self.shareOfBin[binId] == 0) {
+            /// @dev Only for first liquidity provider for the bin, deduct MINIMUM_SHARE, expected to underflow
+            /// if shares < MINIMUM_SHARE for first mint
+            userShareAdded = shares - MINIMUM_SHARE;
+        }
+
+        self.positions.get(owner, binId, salt).addShare(userShareAdded);
         self.shareOfBin[binId] += shares;
     }
 

test/pool-bin/BinHookReturnsDelta.t.sol

@@ -127,7 +127,7 @@ contract BinHookReturnsDelta is Test, GasSnapshot, BinTestHelper {
         binLiquidityHelper.burn(key, burnParams, "");
 
         (uint128 reserveXAfter, uint128 reserveYAfter,,) = poolManager.getBin(key.toId(), activeId);
-
+        // reserve non zero due to min liquidity locked up in the bin
         assertEq(reserveXAfter, 0);
         assertEq(reserveYAfter, 0);
         assertEq(token0.balanceOf(address(binReturnsDeltaHook)), 0.1 ether);

test/pool-bin/BinMintBurnFeeHook.t.sol

@@ -113,6 +113,7 @@ contract BinMintBurnFeeHookTest is Test, GasSnapshot, BinTestHelper {
         assertEq(vault.balanceOf(address(binMintBurnFeeHook), key.currency0), 2 ether);
         assertEq(vault.balanceOf(address(binMintBurnFeeHook), key.currency1), 2 ether);
 
+        // take 4x the burn amount as fee
         IBinPoolManager.BurnParams memory burnParams =
             _getSingleBinBurnLiquidityParams(key, poolManager, activeId, address(binLiquidityHelper), 100);
         snapStart("BinMintBurnFeeHookTest#test_Burn");

test/pool-bin/BinPoolManager.t.sol

@@ -458,9 +458,17 @@ contract BinPoolManagerTest is Test, GasSnapshot, BinTestHelper {
         for (uint256 i = 0; i < binIds.length; i++) {
             (uint128 binReserveX, uint128 binReserveY,,) = poolManager.getBin(key.toId(), binIds[i]);
 
-            // make sure the liquidity is added to the correct bin
-            assertEq(binReserveX, 0 ether);
-            assertEq(binReserveY, 0 ether);
+            // should have 1 token left due to min liquidity
+            if (binIds[i] < activeId) {
+                assertEq(binReserveX, 0);
+                assertEq(binReserveY, 0);
+            } else if (binIds[i] > activeId) {
+                assertEq(binReserveX, 0);
+                assertEq(binReserveY, 0);
+            } else {
+                assertEq(binReserveX, 0);
+                assertEq(binReserveY, 0);
+            }
 
             BinPosition.Info memory position =
                 poolManager.getPosition(key.toId(), address(binLiquidityHelper), binIds[i], salt);
@@ -480,6 +488,7 @@ contract BinPoolManagerTest is Test, GasSnapshot, BinTestHelper {
         token0.mint(address(this), 30 ether);
         token1.mint(address(this), 30 ether);
 
+        // mint for salt1
         (IBinPoolManager.MintParams memory mintParams, uint24[] memory binIds) =
             _getMultipleBinMintParams(activeId, 2 ether, 2 ether, 5, 5, salt1);
         binLiquidityHelper.mint(key, mintParams, "");
@@ -514,6 +523,7 @@ contract BinPoolManagerTest is Test, GasSnapshot, BinTestHelper {
         }
 
         {
+            // now mint for salt2
             (mintParams, binIds) = _getMultipleBinMintParams(activeId, 2 ether, 2 ether, 5, 5, salt2);
             binLiquidityHelper.mint(key, mintParams, "");
 
@@ -542,11 +552,13 @@ contract BinPoolManagerTest is Test, GasSnapshot, BinTestHelper {
                 // only position with salt 0 should be empty
                 assertTrue(position0.share == 0);
                 assertTrue(position1.share != 0);
-                assertTrue(position1.share == position2.share);
+                // // 1e3 is MINIMUM_SHARE locked when added liquidity first
+                assertTrue(position1.share + 1e3 == position2.share);
             }
         }
 
         {
+            // now mint for salt0
             (mintParams, binIds) = _getMultipleBinMintParams(activeId, 2 ether, 2 ether, 5, 5, salt0);
             binLiquidityHelper.mint(key, mintParams, "");
 
@@ -572,9 +584,10 @@ contract BinPoolManagerTest is Test, GasSnapshot, BinTestHelper {
                 BinPosition.Info memory position2 =
                     poolManager.getPosition(key.toId(), address(binLiquidityHelper), binIds[i], salt2);
 
+                // 1e3 is MINIMUM_SHARE locked when added liquidity first
                 assertTrue(position0.share != 0);
-                assertTrue(position1.share == position0.share);
-                assertTrue(position1.share == position2.share);
+                assertTrue(position1.share + 1e3 == position0.share);
+                assertTrue(position1.share + 1e3 == position2.share);
             }
         }
 
@@ -589,13 +602,13 @@ contract BinPoolManagerTest is Test, GasSnapshot, BinTestHelper {
             // make sure the liquidity is added to the correct bin
             if (binIds[i] < activeId) {
                 assertEq(binReserveX, 0 ether);
-                assertEq(binReserveY, 0.4 ether * 2);
+                assertEq(binReserveY, 0.4 ether * 2 + 1);
             } else if (binIds[i] > activeId) {
-                assertEq(binReserveX, 0.4 ether * 2);
+                assertEq(binReserveX, 0.4 ether * 2 + 1);
                 assertEq(binReserveY, 0 ether);
             } else {
-                assertEq(binReserveX, 0.4 ether * 2);
-                assertEq(binReserveY, 0.4 ether * 2);
+                assertEq(binReserveX, 0.4 ether * 2 + 1);
+                assertEq(binReserveY, 0.4 ether * 2 + 1);
             }
 
             BinPosition.Info memory position0 =
@@ -628,7 +641,7 @@ contract BinPoolManagerTest is Test, GasSnapshot, BinTestHelper {
         uint256[] memory ids = new uint256[](1);
         bytes32[] memory amounts = new bytes32[](1);
         ids[0] = activeId;
-        amounts[0] = uint128(1e18).encode(uint128(1e18));
+        amounts[0] = 0x00000000000000000de0b6b3a764000000000000000000000de0b6b3a7640000; // <wip> uint128(1e18).encode(uint128(1e18));
         vm.expectEmit();
         emit IBinPoolManager.Burn(key.toId(), address(binLiquidityHelper), ids, 0, amounts);
 
@@ -697,7 +710,7 @@ contract BinPoolManagerTest is Test, GasSnapshot, BinTestHelper {
         uint256[] memory ids = new uint256[](1);
         bytes32[] memory amounts = new bytes32[](1);
         ids[0] = activeId;
-        amounts[0] = uint128(1e18).encode(uint128(1e18));
+        amounts[0] = 0x00000000000000000de0b6b3a764000000000000000000000de0b6b3a7640000; // <wip> to fill in numbers uint128(1e18).encode(uint128(1e18));
         vm.expectEmit();
         emit IBinPoolManager.Burn(key.toId(), address(binLiquidityHelper), ids, 0, amounts);
 

test/pool-bin/BinPoolManagerBehaviorComparison.t.sol

@@ -36,6 +36,9 @@ abstract contract LBFuzzer is LBHelper, BinTestHelper {
     Currency currency0;
     Currency currency1;
 
+    /// @dev when a bin has supply for the first time, 1e3 share will be locked up
+    uint256 constant MINIMUM_SHARE = 1e3;
+
     function setUp() public virtual override {
         super.setUp();
 
@@ -135,9 +138,18 @@ abstract contract LBFuzzer is LBHelper, BinTestHelper {
         for (uint256 i = 0; i < liquidityMinted.length; i++) {
             uint24 id = uint24(uint256(mintParams.liquidityConfigs[i]));
             BinPosition.Info memory positionInfoAfter = manager.getPosition(key.toId(), address(liquidityHelper), id, 0);
-            assertEq(
-                liquidityMinted[i], positionInfoAfter.share - sharesBefore[i], "Expecting to mint same liquidity !"
-            );
+            if (sharesBefore[i] == 0) {
+                // first mint, so positionInfoAfter.share has MINIMUM_SHARE lesser
+                assertEq(
+                    liquidityMinted[i],
+                    positionInfoAfter.share - sharesBefore[i] + MINIMUM_SHARE,
+                    "Expecting to mint same liquidity !"
+                );
+            } else {
+                assertEq(
+                    liquidityMinted[i], positionInfoAfter.share - sharesBefore[i], "Expecting to mint same liquidity !"
+                );
+            }
         }
     }
 

test/pool-bin/helpers/BinMintBurnFeeHook.sol

@@ -84,10 +84,6 @@ contract BinMintBurnFeeHook is BaseBinTestHook {
         BalanceDelta delta,
         bytes calldata
     ) external override returns (bytes4, BalanceDelta) {
-        console2.log("afterBurn delta");
-        console2.logInt(delta.amount0());
-        console2.logInt(delta.amount1());
-
         int128 amt0Fee;
         if (delta.amount0() > 0) {
             amt0Fee = (delta.amount0()) * 4;

test/pool-bin/libraries/BinPoolDonate.t.sol

@@ -57,16 +57,22 @@ contract BinPoolDonateTest is BinTestHelper {
     }
 
     function testDonate_InsufficientBinShareForDonate(uint256 remainingShare) public {
+        uint256 MINIMUM_SHARE = 1e3;
+
         // Initialize pool and add liqudiity
         poolManager.initialize(key, activeId);
         addLiquidityToBin(key, poolManager, alice, activeId, 1e18, 1e18, 1e18, 1e18, "");
 
         // Remove all share leaving less than MIN_LIQUIDITY_BEFORE_DONATE shares
-        remainingShare = bound(remainingShare, 1, poolManager.minBinShareForDonate() - 1);
+        remainingShare = bound(remainingShare, 1, poolManager.minBinShareForDonate() - 1 - MINIMUM_SHARE);
         uint256 aliceShare = poolManager.getPosition(poolId, alice, activeId, 0).share;
         removeLiquidityFromBin(key, poolManager, alice, activeId, aliceShare - remainingShare, "");
 
-        vm.expectRevert(abi.encodeWithSelector(IBinPoolManager.InsufficientBinShareForDonate.selector, remainingShare));
+        vm.expectRevert(
+            abi.encodeWithSelector(
+                IBinPoolManager.InsufficientBinShareForDonate.selector, remainingShare + MINIMUM_SHARE
+            )
+        );
         poolManager.donate(key, 1e18, 1e18, "");
     }
 
@@ -98,11 +104,12 @@ contract BinPoolDonateTest is BinTestHelper {
         assertEq(removeDelta1.amount0(), 2e18);
         assertEq(removeDelta1.amount1(), 2e18);
 
+        // lesser than 2e18 as alice is the first lp provider and liquidity locked up
         BalanceDelta removeDelta2 = removeLiquidityFromBin(key, poolManager, alice, activeId, aliceShare, "");
         assertEq(removeDelta2.amount0(), 2e18);
         assertEq(removeDelta2.amount1(), 2e18);
 
-        // Verify no reserve remaining
+        // Verify only min_liquidity worth of token locked up
         (reserveX, reserveY,,) = poolManager.getBin(poolId, activeId);
         assertEq(reserveX, 0);
         assertEq(reserveY, 0);