Immediate deposit+withdrawal saturates deposit rate limit capacity

[jordanschalm]

Context

FlowALP has a deposit rate limit mechanism (implemented in #63), which limits the total and per-position deposits per hour.

• When a user makes a deposit, they are limited by this mechanism
  • Each hour, a position can deposit at most $(0.05)(depositCapacityCap)$ (see code)
• When a user makes a withdrawal, this does not impact the available deposit capacity

A user can saturate all deposit capacity, without permanently depositing any funds, with the following workflow:

• Create 20 positions
• Deposit (0.05)(depositCapacityCap) into each position, then withdraw all funds. (They can even do this in the same transaction.)
• The deposit capacity for the deposited token is saturated, and no other users can deposit any tokens for the next hour

Proposed Solution

• Withdrawals should free deposit capacity
  • Need to think about this carefully. Probably we should not allow the depositCapacity to become greater than depositCapacityCap when freeing deposit capacity

[tim-barry]

If we limit depositCapacity to depositCapacityCap when withdrawing, isn't a similar process still possible that saturates the capacity:

• first withdraw (0.05)(depositCapacityCap) from 20 positions, freeing up the deposit capacity up to the cap (but not increasing it past that)
• then deposit it back, which now guarantees the cap is saturated again

This does requires them to ~permanently deposit the funds, but still prevents other users from depositing tokens on net (without other withdrawals happening first).

[jordanschalm]

If we limit depositCapacity to depositCapacityCap when withdrawing, isn't a similar process still possible that saturates the capacity

Good point. I was thinking that the main purpose of the deposit limit mechanism is to avoid large amounts of gross deposits in a short time. But maybe as long as the net deposit over the period is below the limit that's still fine. I don't know. @Gornutz what do you think?

[Gornutz]

As we just talked about in the Q&A, we can go with @tim-barry approach of tracking the net deposits rather than the gross assets.