address review: wire record_yield into repayment path; CEI + invariant guard

Once share value tracks TotalManagedAssets instead of the raw balance, loan
interest transferred into the pool no longer reaches LPs automatically. Wire it
up:

- lending_pool: add a per-token authorized yield reporter
  (set_loan_manager/get_loan_manager, admin-gated, emits LoanManagerUpdated) and
  gate record_yield to that reporter, falling back to admin when unset.
- loan_manager: report the interest + late-fee portion of a repayment and the
  extension fee as yield via record_yield. Best-effort and non-fatal (only when
  configured as the pool's reporter; pool-side errors are swallowed) so it can
  never block a repayment. liquidate is intentionally left unwired and
  documented, since recovered interest needs a paired principal write-off
  (record_loss) to avoid inflating share value during a loss event.

Review nits:
- calc_shares_to_mint documents the managed-assets-positive invariant with a
  debug_assert instead of silently minting 1:1 when total_assets_before == 0.
- redeem_shares now commits all accounting before the token transfer (CEI).

Adds pool tests for reporter gating and end-to-end loan_manager tests proving
repaid interest reaches LP share value and that repayment still succeeds when no
reporter is configured.

Author: xeladev4

lending_pool/src/events.rs

@@ -29,6 +29,11 @@ pub fn yield_distributed(env: &Env, token: Address, amount: i128) {
     env.events().publish(topics, amount);
 }
 
+pub fn loan_manager_updated(env: &Env, token: Address, loan_manager: Address) {
+    let topics = (Symbol::new(env, "LoanManagerUpdated"), token);
+    env.events().publish(topics, loan_manager);
+}
+
 pub fn deposit_cap_updated(
     env: &Env,
     token: Address,

lending_pool/src/lib.rs

@@ -75,6 +75,12 @@ pub enum DataKey {
     /// exchange rate. Unaffected by direct token transfers or by principal
     /// temporarily out on loan. See the module-level accounting note.
     TotalManagedAssets(Address),
+    /// token → address authorized to report realized yield via `record_yield`
+    /// (normally the LoanManager that repayments flow through). Lets the
+    /// repayment path credit interest to LPs automatically while keeping
+    /// `record_yield` gated, so arbitrary callers still cannot move the share
+    /// price.
+    LoanManager(Address),
     /// token → number of active depositors
     DepositorCount(Address),
     ProposedAdmin,
@@ -172,6 +178,14 @@ impl LendingPool {
         Self::bump_instance_ttl(env);
     }
 
+    /// Address authorized to report realized yield for `token`, if configured.
+    fn loan_manager(env: &Env, token: &Address) -> Option<Address> {
+        Self::bump_instance_ttl(env);
+        env.storage()
+            .instance()
+            .get(&DataKey::LoanManager(token.clone()))
+    }
+
     fn read_shares(env: &Env, provider: &Address, token: &Address) -> i128 {
         let key = DataKey::Shares(provider.clone(), token.clone());
         let shares: i128 = env.storage().persistent().get(&key).unwrap_or(0);
@@ -231,9 +245,20 @@ impl LendingPool {
         total_assets_before: i128,
         cur_total_shares: i128,
     ) -> i128 {
-        if cur_total_shares == 0 || total_assets_before == 0 {
+        if cur_total_shares == 0 {
+            // First depositor into an empty share pool: 1:1 allocation.
             amount
         } else {
+            // Invariant: once shares exist, managed assets are strictly positive.
+            // deposit and redeem move shares and managed assets together, and
+            // record_yield only ever increases managed assets (and requires
+            // shares > 0), so `total_assets_before == 0` here is unreachable. The
+            // checked_div below would surface any violation as a panic rather
+            // than silently minting a diluting 1:1 allocation.
+            debug_assert!(
+                total_assets_before > 0,
+                "managed assets must be positive while shares are outstanding"
+            );
             amount
                 .checked_mul(cur_total_shares)
                 .and_then(|v| v.checked_div(total_assets_before))
@@ -319,12 +344,6 @@ impl LendingPool {
             .and_then(|v| v.checked_div(cur_total_shares))
             .expect("principal redeem overflow");
 
-        TokenClient::new(env, token).transfer(
-            &env.current_contract_address(),
-            provider,
-            &assets_to_return,
-        );
-
         let share_key = DataKey::Shares(provider.clone(), token.clone());
         let deposit_key = DataKey::DepositTimestamp(provider.clone(), token.clone());
         let remaining = cur_shares.checked_sub(shares).expect("share underflow");
@@ -363,6 +382,15 @@ impl LendingPool {
             .set(&DataKey::TotalDeposits(token.clone()), &new_total_deposits);
 
         Self::bump_instance_ttl(env);
+
+        // Interaction last (checks-effects-interactions): all accounting is
+        // committed before the token leaves the pool.
+        TokenClient::new(env, token).transfer(
+            &env.current_contract_address(),
+            provider,
+            &assets_to_return,
+        );
+
         Ok(assets_to_return)
     }
 
@@ -702,22 +730,49 @@ impl LendingPool {
         Ok(())
     }
 
+    /// Authorize `loan_manager` to report realized yield for `token` via
+    /// [`record_yield`](Self::record_yield). Set this to the LoanManager that
+    /// repayments flow through so interest is credited to LPs automatically.
+    /// Admin-gated.
+    pub fn set_loan_manager(env: Env, token: Address, loan_manager: Address) {
+        Self::admin(&env).require_auth();
+        env.storage()
+            .instance()
+            .set(&DataKey::LoanManager(token.clone()), &loan_manager);
+        Self::bump_instance_ttl(&env);
+        loan_manager_updated(&env, token, loan_manager);
+    }
+
+    /// The address authorized to report yield for `token`, if any.
+    pub fn get_loan_manager(env: Env, token: Address) -> Option<Address> {
+        Self::loan_manager(&env, &token)
+    }
+
     /// Record `amount` of realized yield (e.g. loan interest repaid into the
     /// pool), raising every outstanding share's value pro-rata.
     ///
     /// This is the *only* way assets enter share value besides deposits. Because
     /// a contract cannot distinguish a legitimate interest repayment from an
     /// unsolicited donation by looking at its balance, yield is recognised
-    /// through this deliberate, admin-gated call rather than by reading the raw
+    /// through this deliberate, access-gated call rather than by reading the raw
     /// balance. That is precisely what stops a direct transfer from arbitrarily
     /// changing existing holders' redeemable value (issue #2).
     ///
+    /// Authorization: the configured [`LoanManager`] reporter for `token` (so the
+    /// repayment path can credit interest automatically), or the admin when no
+    /// reporter is configured (manual / keeper operation).
+    ///
     /// Yield is not principal, so it does not move `TotalDeposits` or count
     /// against the `MaxPoolSize` cap. The caller is responsible for ensuring the
     /// corresponding tokens are actually present in the pool; otherwise later
     /// redemptions will hit the `InsufficientLiquidity` gate.
     pub fn record_yield(env: Env, token: Address, amount: i128) -> Result<(), PoolError> {
-        Self::admin(&env).require_auth();
+        // Gate on the configured yield reporter, falling back to admin so the
+        // function is still usable manually before a LoanManager is wired up.
+        match Self::loan_manager(&env, &token) {
+            Some(reporter) => reporter.require_auth(),
+            None => Self::admin(&env).require_auth(),
+        }
         Self::assert_not_paused(&env)?;
 
         if amount <= 0 {

lending_pool/src/test.rs

@@ -1683,3 +1683,87 @@ fn test_record_yield_rejected_when_no_shares_outstanding() {
     let res = pool_client.try_record_yield(&token_id, &100);
     assert_eq!(res, Err(Ok(crate::PoolError::InvalidAmount)));
 }
+
+#[test]
+fn test_record_yield_gated_to_configured_reporter() {
+    // Once a loan-manager reporter is configured for a token, it (and not the
+    // admin) is the authority for record_yield — this is what lets the
+    // repayment path credit interest automatically while still blocking
+    // arbitrary callers.
+    let env = Env::default();
+
+    let admin = Address::generate(&env);
+    let (token_id, stellar_asset_client, _token_client) = create_token_contract(&env, &admin);
+
+    let pool_id = env.register(LendingPool, ());
+    let pool_client = LendingPoolClient::new(&env, &pool_id);
+
+    env.mock_all_auths();
+    pool_client.initialize(&admin);
+    pool_client.set_withdrawal_cooldown(&0);
+
+    let provider = Address::generate(&env);
+    stellar_asset_client.mint(&provider, &1_000);
+    pool_client.deposit(&provider, &token_id, &1_000);
+
+    let reporter = Address::generate(&env);
+    pool_client.set_loan_manager(&token_id, &reporter);
+    assert_eq!(
+        pool_client.get_loan_manager(&token_id),
+        Some(reporter.clone())
+    );
+
+    // The configured reporter can record yield.
+    env.mock_auths(&[soroban_sdk::testutils::MockAuth {
+        address: &reporter,
+        invoke: &soroban_sdk::testutils::MockAuthInvoke {
+            contract: &pool_id,
+            fn_name: "record_yield",
+            args: (token_id.clone(), 100i128).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+    pool_client.record_yield(&token_id, &100);
+    assert_eq!(pool_client.get_total_managed_assets(&token_id), 1_100);
+
+    // The admin is no longer the authority once a reporter is configured.
+    env.mock_auths(&[soroban_sdk::testutils::MockAuth {
+        address: &admin,
+        invoke: &soroban_sdk::testutils::MockAuthInvoke {
+            contract: &pool_id,
+            fn_name: "record_yield",
+            args: (token_id.clone(), 50i128).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+    assert!(pool_client.try_record_yield(&token_id, &50).is_err());
+}
+
+#[test]
+fn test_set_loan_manager_requires_admin() {
+    let env = Env::default();
+
+    let admin = Address::generate(&env);
+    let (token_id, _stellar_asset_client, _token_client) = create_token_contract(&env, &admin);
+
+    let pool_id = env.register(LendingPool, ());
+    let pool_client = LendingPoolClient::new(&env, &pool_id);
+
+    env.mock_all_auths();
+    pool_client.initialize(&admin);
+
+    let reporter = Address::generate(&env);
+    let attacker = Address::generate(&env);
+    env.mock_auths(&[soroban_sdk::testutils::MockAuth {
+        address: &attacker,
+        invoke: &soroban_sdk::testutils::MockAuthInvoke {
+            contract: &pool_id,
+            fn_name: "set_loan_manager",
+            args: (token_id.clone(), reporter.clone()).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+    assert!(pool_client
+        .try_set_loan_manager(&token_id, &reporter)
+        .is_err());
+}