tradi3_

MidnightBundles minUnits check can pass before callback-created loss slashes received credit

MidnightBundles.buyWithAssetsTargetAndWithdrawCollateral() documents that the taker gains at least minUnits. It counts the raw units returned by Midnight.take(), before the taker’s position is synced against the market’s current lossFactor.

A sell-offer maker can use its own seller callback to liquidate a different bad-debt borrower in the same market. That liquidation raises lossFactor after the buyer has been credited but before the bundle returns. The bundle still adds unitsToTake to filledUnits and passes require(filledUnits >= minUnits).

The taker pays for 100 units, passes minUnits = 100e18, and after updatePosition() holds about 30.6 units.

Affected: morpho-org/midnight @ 7538c438513622721e23a94676b93a335b83dace