[CL][bug]: Bankers rounding in price to tick conversions allows for LP fund drain

[AlpinYukseloglu]

Background

Example attack vector: #5493

We currently do bankers rounding to accommodate the precision loss we experience when converting from sqrt price to tick. This is specifically intended to handle the case where the error pushes the tick over a boundary such that truncating would lead the wrong outcome (e.g. the price corresponding to tick 100 gets represented as 99.999, which gets truncated to 99).

While this seems okay in most cases, it causes undefined behavior when a swap leaves the current sqrt price close enough to a tick boundary to trigger a round up when converted to ticks.

Specifically, it allows for a scenario where it is possible to break the invariant that currentSqrtPrice <= TickToSqrtPrice(currentTick). In other words, the current tick is set incorrectly since the tick is rounded up due to conflating delta from precision error with actual delta.

Suggested Design

We have two primary approaches to resolving this issue:

1. After each price to tick conversion, check the price corresponding to the ticks above and below the output and return the tick that correctly represents the original given price
2. Truncate instead of doing bankers rounding, and implement a new ApproxRoot function that prevents the issue in [CL]: Demo issue with truncation for ticks #5512 from happening (likely requires a sqrt function that always returns >= the true sqrt)

Acceptance Criteria

• The example given in the attack vector is resolved