# Arc Live E2E — Stage 7 + Stage 5 Verification Summary

**Date:** 2026-05-28 / 2026-05-29
**Chain:** Arc testnet (5042002)
**Branch:** `feat/quantum-risk-engine`

## What was verified LIVE on-chain

### ✅ Step 1 — Multi-asset deposit (commit `8d65715` then `94f1d17`)
- Deployer deposited 0.001364 WBTC ($100) + 0.0503 WETH ($100)
- `QRE.equity18` = **$170.10** (matches predicted: $100 × 0.95 × 0.90 + $100 × 0.94 × 0.90)
- ✅ Shock pricing + per-asset LTV applied correctly

### ✅ Step 2 — Native USDC deposit + initial open attempt (commit `afe603e`)
- Deployer deposited 100 USDC via `BalanceManager.depositNative{value}()`
- `QRE.equity18` = **$270** (basket $170 + USDC ~$100)
- Attempted to open $1,320 notional XAU-PERP @ 10x ($132 IM)
- **REVERTED** with `InsufficientBalance(132, 100)` — V1 collateral path didn't admit basket backing
- **Surfaced the Stage 7 gap** that triggered the entire Stage 7 implementation cycle

### ✅ Stage 7 implementation + 3 rounds of paired Pashov + Nemesis audits (commit `8d1a5f6`)
- 939 tests passing; both audits converged clean
- See `.audit/findings/STAGE7_AUDIT_REPORT.md` for the complete audit trail

### ✅ Step 3+3b — Position open via Stage 7 V2 (commits `34796ac` then `921212d`)
- BMV impl upgraded to Stage 7 (beacon `0xe90b8Bb214Df56a6C82Ef738a3A1dBD3F07aEE32`)
- CLOBPerpetualRouter impl upgraded to Stage 7 (beacon `0x4278Ae9B978d1185D8d1015145D3Bf2509cAF63b`)
- QRE redeployed (not UUPS — fresh proxy `0x620eB8FbCc4Adb93548913698da146D11a29b147`)
- Counterparty wallet (deterministic `keccak256("clob-dex-qre-counterparty-v1")` = `0xa221D33c...`) funded with 200 USDC native
- **Both positions filled**:
  - Deployer LONG XAU-PERP 0.1 oz @ $4400 (orderId 5594); IM $132; **USDC-locked $100; virtually-backed $32** ← Stage 7 LIVE
  - Counterparty SHORT XAU-PERP 0.1 oz @ $4400; full USDC backing $132

### ✅ Step 4 — Oracle crash + liquidation (commit `921212d`)
- XAU price dropped $4,427 → $2,654 (40% via 10-pp/step around deviation cap)
- Deployer's `QRE.equity18`: +$212 → **−$294** (well below MM $39.60)
- `QRE.isLiquidatable: true` + `BMV.canLiquidateCrossMargin: true` ✓
- `liquidatePosition` SUCCESS (orderId 5605); position closed; $100 USDC consumed
- Counterparty credited with $236 profit (from her SHORT side)

### ✅ Step 5 — Stage 5 wiring applied (commit `ce7805a`)
- `BMV.setLiquidationConfig(PoolManager, Oracle, 500bps slippage)` ✓
- `PoolManager.setAuthorizedRouter((WBTC,USDC), BMV, true)` ✓
- `PoolManager.setAuthorizedRouter((WETH,USDC), BMV, true)` ✓
- Spot bids attempted from counterparty but did not land (broadcast-bundling artifact when a later
  tx in the same script reverted) — verified post-test that `lockedBalanceOf[CP, SPOT_ROUTER, USDC] = 0`

### ✅ Step 6 — Pure-virtual liquidation cycle (commit `da1208c`)
- Deployer had $0 USDC + $170 basket (post Step 4)
- Counterparty placed SHORT XAU-PERP 0.1 @ $4000 (orderId 5675)
- Deployer placed LONG XAU-PERP 0.1 @ $4000 — Stage 7 V2 attempted to open with $0 USDC
- Allocation result: claim $172, USDC-locked $100, virtual $72
  - Note: claim of $172 vs expected $40 reflects a residual deployer USDC balance picked up at
    allocate-time (under investigation — likely state from earlier session that wasn't fully drained)
- XAU crashed $4000 → $2000 (50% via 5 stepped setPrice calls)
- Deployer's QRE.equity18: +$75 → **−$628** (deeply liquidatable)
- `liquidatePosition` SUCCESS (orderId 5677); position closed
- **Stage 5 was called but did not fire** — `_coverDeficitWithCollateral` invoked
  `liquidationSellCollateral` for each enabled non-USDC collateral, but each call REVERTED
  (no resting bids → no fill → revert at `CollateralSellNoFill` or floor check), and the outer
  `try/catch` correctly swallowed the failures per Security Rule 17 ("never brick liquidation")
- $100 deficit ($200 loss − $100 locked) absorbed by insurance fund (the fallback path)

## Mechanism vs Liquidity

The complete Stage 5 flow is wired and EXECUTES correctly on Arc:
1. ✅ `_handleRelease` detects `finalCollateral < 0` and `mode == CROSS`
2. ✅ `_settleCrossAccountDeficit` covers from free USDC first (none here)
3. ✅ Calls `_coverDeficitWithCollateral` since `poolManager + QRE + priceOracle` all wired
4. ✅ Iterates enabled collaterals (WBTC, WETH), skipping USDC
5. ✅ Attempts `liquidationSellCollateral` (self-call wrapped in try/catch)
6. ❌ Each per-asset sell reverts because **no resting spot bids exist** on WBTC/USDC or
       WETH/USDC pools at or above `oracle × liqFactorBps (95%)`
7. ✅ Try/catch swallows the per-asset failure; deficit cascades to insurance + bad-debt event

**This is the CORRECT behavior under Security Rule 17** — never block a liquidation just because
the spot side can't fill. The basket-sale is a best-effort safety net for when insurance is thin
AND non-USDC collateral can be sold for liqFactor-grade prices.

## What this proves vs what's still pending

| Capability | Live-verified | Notes |
|---|---|---|
| Multi-asset deposit (WBTC + WETH + USDC) | ✅ | Steps 1, 2, 3 |
| QRE.equity18 valuation with shock + LTV | ✅ | Steps 1, 2 |
| Stage 7 V2 position open with virtual backing | ✅ | **Step 3b** — $132 IM with $100 USDC + $32 virtual |
| Stage 7 V2 PURE virtual (USDC = 0) | ⚠️ | Step 6 attempted but allocated $100 USDC unexpectedly — pending fresh state |
| Order book matching → filled positions | ✅ | Step 3b, Step 6 |
| Oracle price manipulation (trusted-updater path) | ✅ | Steps 4, 6 — bypassed via stepped 10pp drops |
| QRE.isLiquidatable correctly flips on equity < MM | ✅ | Steps 4, 6 |
| `liquidatePosition` closes the underwater position | ✅ | Steps 4 (orderId 5605), 6 (orderId 5677) |
| Stage 5 wiring (`setLiquidationConfig` + `setAuthorizedRouter`) | ✅ | Step 5 |
| Stage 5 `_coverDeficitWithCollateral` invoked | ✅ | Step 6 (verified via control flow) |
| Stage 5 actually SELLS basket | ❌ | Needs resting spot bids ≥ floor — testnet liquidity gap |
| QRE netting (basket asset ↔ opposite perp) | N/A | Arc has no BTC-PERP / ETH-PERP markets — Monad-only test |
| Withdraw gate (`solventAfterWithdrawal`) live | ⚠️ | Function called in Step 2 but reverted on diagnostic — needs fresh-state probe |

## Deployed Stage 7 contracts (Arc)

| Contract | Address | Status |
|---|---|---|
| BalanceManagerVault impl | `0xab9b222d43010803bF04Bf6EbaC9D98C49B98474` | beacon-upgraded |
| CLOBPerpetualRouter impl | `0x1A37E7EA717C0E4296a2535337a8182d652e5e6A` | beacon-upgraded |
| QuantumRiskEngine proxy | `0x620eB8FbCc4Adb93548913698da146D11a29b147` | fresh deploy |
| QuantumRiskEngine impl | `0xa7f538211A7B2d39341b0f6c5Cf9c78A2E0bB0a2` | (non-UUPS) |
| RiskOracle | `0x2E53A24b6347b79713C659C56c79B5661fdd84e2` | configured |

## Follow-ups for full Stage 5 fire demonstration

To complete the live basket-sale verification, a follow-up test session needs:

1. **Resting spot bids on WBTC/USDC and WETH/USDC** at or above `oracle × 0.95`. Options:
   - Fund a third wallet with ~$200 USDC and place limit bids via individual `cast send` calls
     (avoids the broadcast-bundling issue the forge script run into)
   - OR run a market-making bot temporarily on those pools
2. **Fresh deployer wallet** with $0 USDC at allocate time, only basket collateral — clean state
3. **Single transaction flow:** open pure-virtual position → price crash → liquidate, all from
   one session so state doesn't drift between steps

Estimated time: 30-60 min on next session. The mechanism is fully wired; only the spot liquidity
side needs the right setup.

## Audit posture

- **Pashov + Nemesis: clean** (3 rounds each on Stage 7 surface)
- **939 tests passing / 0 failures**
- Consolidated audit report at `.audit/findings/STAGE7_AUDIT_REPORT.md`

## Commit chain (chronological)
- `94f1d17` — Step 1: multi-asset basket equity verified live
- `99099b3` — DeployQREMonad housekeeping
- `afe603e` — Step 2: native USDC deposit + Stage-7 gap surfaced
- `2075408` — Stage 7 design doc
- `8107c35` — Stage 7 implementation (R1) — 921+10 tests
- `65be836` — Stage 7 audit R1 fixes (Pashov C-1/H-1/H-2/M-1/M-2/L-3 + Nemesis NM-001..005)
- `63f1e68` — Stage 7 audit R2 fixes (M-7b + NM-R2-001; M-7a rejected as FP)
- `8d1a5f6` — Stage 7 consolidated audit report (R3 clean)
- `34796ac` — Step 2 re-run: Stage 7 V2 open succeeds (orderId 5532)
- `921212d` — Step 3b + Step 4: dual positions filled, liquidation via oracle crash
- `ce7805a` — Step 5: Stage 5 wiring applied on Arc
- `da1208c` — Step 6: pure-virtual liquidation cycle (Stage 5 wiring confirmed, no basket sale)