LoanPay.cpp

#include <xrpl/tx/transactors/lending/LoanPay.h>
 
#include <xrpl/basics/Log.h>
#include <xrpl/basics/Number.h>
#include <xrpl/beast/utility/Journal.h>
#include <xrpl/beast/utility/Zero.h>
#include <xrpl/beast/utility/instrumentation.h>
#include <xrpl/json/to_string.h>
#include <xrpl/ledger/ReadView.h>
#include <xrpl/ledger/helpers/LendingHelpers.h>
#include <xrpl/ledger/helpers/TokenHelpers.h>
#include <xrpl/protocol/AccountID.h>
#include <xrpl/protocol/Asset.h>
#include <xrpl/protocol/Feature.h>
#include <xrpl/protocol/Indexes.h>
#include <xrpl/protocol/LedgerFormats.h>
#include <xrpl/protocol/Protocol.h>
#include <xrpl/protocol/SField.h>
#include <xrpl/protocol/STAmount.h>
#include <xrpl/protocol/STLedgerEntry.h>
#include <xrpl/protocol/STTakesAsset.h>
#include <xrpl/protocol/STTx.h>
#include <xrpl/protocol/TER.h>
#include <xrpl/protocol/TxFlags.h>
#include <xrpl/protocol/Units.h>
#include <xrpl/protocol/XRPAmount.h>
#include <xrpl/tx/Transactor.h>
#include <xrpl/tx/transactors/lending/LoanManage.h>
 
#include <algorithm>
#include <bit>
#include <cstdint>
#include <expected>
#include <vector>
 
namespace xrpl {
 
namespace {
// Returns true if the transaction's payment amount is malformed. A loan
// payment must be strictly positive: zero would move nothing, and a negative
// amount is not a payment at all.
bool
isPaymentAmountInvalid(STAmount const& amount)
{
    return amount <= beast::kZero;
}
 
// Returns the account's true, unclamped balance in `asset`, for use only in
// fund-conservation checks. accountHolds(..., SpendableHandling::FullBalance)
// cannot be used for this: for XRP it always defers to xrpLiquid, which
// subtracts the account's reserve, so a payee sitting below its own reserve
// would appear to receive nothing even though its raw ledger balance grew.
// That mismatch is exactly what a conservation check must not see.
STAmount
conservationBalance(ReadView const& view, AccountID const& id, Asset const& asset, beast::Journal j)
{
    if (isXRP(asset))
    {
        auto const sle = view.read(keylet::account(id));
        if (!sle)
            return STAmount{asset};  // LCOV_EXCL_LINE
        return view.balanceHookIOU(id, xrpAccount(), sle->getFieldAmount(sfBalance));
    }
    return accountHolds(
        view,
        id,
        asset,
        FreezeHandling::IgnoreFreeze,
        AuthHandling::IgnoreAuth,
        j,
        SpendableHandling::FullBalance);
}
}  // namespace
 
bool
LoanPay::checkExtraFeatures(PreflightContext const& ctx)
{
    return checkLendingProtocolDependencies(ctx.rules, ctx.tx);
}
 
std::uint32_t
LoanPay::getFlagsMask(PreflightContext const& ctx)
{
    return tfLoanPayMask;
}
 
NotTEC
LoanPay::preflight(PreflightContext const& ctx)
{
    if (ctx.tx[sfLoanID] == beast::kZero)
        return temINVALID;
 
    if (isPaymentAmountInvalid(ctx.tx[sfAmount]))
        return temBAD_AMOUNT;
 
    // The loan payment flags are all mutually exclusive. If more than one is
    // set, the tx is malformed.
    static_assert(
        (tfLoanLatePayment | tfLoanFullPayment | tfLoanOverpayment) ==
        ~(tfLoanPayMask | tfUniversal));
    auto const flagsSet = ctx.tx.getFlags() & ~(tfLoanPayMask | tfUniversal);
    if (std::popcount(flagsSet) > 1)
    {
        JLOG(ctx.j.warn()) << "Only one LoanPay flag can be set per tx. " << flagsSet
                           << " is too many.";
        return temINVALID_FLAG;
    }
 
    return tesSUCCESS;
}
 
XRPAmount
LoanPay::calculateBaseFee(ReadView const& view, STTx const& tx)
{
    auto fixEnabled313 = view.rules().enabled(fixCleanup3_1_3);
    auto fixEnabled340 = view.rules().enabled(fixCleanup3_4_0);
 
    using namespace lending;
 
    auto const normalCost = Transactor::calculateBaseFee(view, tx);
 
    if (fixEnabled340 && isPaymentAmountInvalid(tx[sfAmount]))
    {
        // Let preflight worry about the error for this
        return normalCost;
    }
 
    if (tx.isFlag(tfLoanFullPayment) || tx.isFlag(tfLoanLatePayment))
    {
        // The loan will be making one set of calculations for one full or late
        // payment
        return normalCost;
    }
 
    // The fee is based on the potential number of payments, unless the loan is
    // being fully paid off.
    auto const amount = tx[sfAmount];
    auto const loanID = tx[sfLoanID];
 
    auto const loanSle = view.read(keylet::loan(loanID));
    if (!loanSle)
    {
        // Let preclaim worry about the error for this
        return normalCost;
    }
 
    if (loanSle->at(sfPaymentRemaining) <= kLoanPaymentsPerFeeIncrement)
    {
        // If there are fewer than kLoanPaymentsPerFeeIncrement payments left to
        // pay, we can skip the computations.
        return normalCost;
    }
 
    if (isPaymentLate(view, loanSle))
    {
        // If the payment is late, and the late payment flag is not set, it'll
        // fail. Uses isPaymentLate() so the fee matches apply at the exact
        // NextPaymentDueDate boundary (Exclusive once fixCleanup3_4_0 is
        // enabled): a catch-up at that instant can still process up to
        // kLoanMaximumPaymentsPerTransaction payments.
        return normalCost;
    }
 
    auto const brokerSle = view.read(keylet::loanBroker(loanSle->at(sfLoanBrokerID)));
    if (!brokerSle)
    {
        // Let preclaim worry about the error for this
        return normalCost;
    }
    auto const vaultSle = view.read(keylet::vault(brokerSle->at(sfVaultID)));
    if (!vaultSle)
    {
        // Let preclaim worry about the error for this
        return normalCost;
    }
 
    auto const asset = vaultSle->at(sfAsset);
 
    if (asset != amount.asset())
    {
        // Let preclaim worry about the error for this
        return normalCost;
    }
 
    auto const scale = loanSle->at(sfLoanScale);
 
    auto const regularPayment = roundPeriodicPayment(asset, loanSle->at(sfPeriodicPayment), scale) +
        loanSle->at(sfLoanServiceFee);
 
    // If making an overpayment, count it as a full payment because it will do
    // about the same amount of work, if not more.
    NumberRoundModeGuard const mg(
        tx.isFlag(tfLoanOverpayment) ? Number::RoundingMode::Upward
                                     : Number::RoundingMode::Downward);
 
    static_assert(kLoanMaximumPaymentsPerTransaction % kLoanPaymentsPerFeeIncrement == 0);
    static constexpr std::int64_t kMaxFeeIncrements =
        kLoanMaximumPaymentsPerTransaction / kLoanPaymentsPerFeeIncrement;
 
    if (fixEnabled313 && amount >= regularPayment * kLoanMaximumPaymentsPerTransaction)
    {
        // The payment handler will never process more than
        // loanMaximumPaymentsPerTransaction payments (including overpayments),
        // and one fee increment is charged for every
        // loanPaymentsPerFeeIncrement, so don't charge more than
        // loanMaximumPaymentsPerTransaction / loanPaymentsPerFeeIncrement fee
        // increments.
        return kMaxFeeIncrements * normalCost;
    }
 
    // Estimate how many payments will be made
    Number const numPaymentEstimate = static_cast<std::int64_t>(amount / regularPayment);
 
    // Charge one base fee per paymentsPerFeeIncrement payments, rounding up.
    // This set round is safe because there's a mode guard just above
    Number::setround(Number::RoundingMode::Upward);
    auto const feeIncrements = std::max(
        std::int64_t(1),
        static_cast<std::int64_t>(numPaymentEstimate / kLoanPaymentsPerFeeIncrement));
    XRPL_ASSERT(
        !view.rules().enabled(fixCleanup3_1_3) || feeIncrements <= kMaxFeeIncrements,
        "xrpl::LoanPay::calculateBaseFee : number of fee increments is in "
        "range");
 
    return feeIncrements * normalCost;
}
 
TER
LoanPay::preclaim(PreclaimContext const& ctx)
{
    auto const& tx = ctx.tx;
 
    auto const account = tx[sfAccount];
    auto const loanID = tx[sfLoanID];
    auto const amount = tx[sfAmount];
 
    auto const loanSle = ctx.view.read(keylet::loan(loanID));
    if (!loanSle)
    {
        JLOG(ctx.j.warn()) << "Loan does not exist.";
        return tecNO_ENTRY;
    }
 
    if (loanSle->at(sfBorrower) != account)
    {
        JLOG(ctx.j.warn()) << "Loan does not belong to the account.";
        return tecNO_PERMISSION;
    }
 
    if (tx.isFlag(tfLoanOverpayment) && !loanSle->isFlag(lsfLoanOverpayment))
    {
        JLOG(ctx.j.warn()) << "Requested overpayment on a loan that doesn't allow it";
        return ctx.view.rules().enabled(fixCleanup3_1_3) ? TER{tecNO_PERMISSION} : temINVALID_FLAG;
    }
 
    auto const principalOutstanding = loanSle->at(sfPrincipalOutstanding);
    auto const paymentRemaining = loanSle->at(sfPaymentRemaining);
 
    if (paymentRemaining == 0 || principalOutstanding == 0)
    {
        JLOG(ctx.j.warn()) << "Loan is already paid off.";
        return tecKILLED;
    }
 
    auto const loanBrokerID = loanSle->at(sfLoanBrokerID);
    auto const loanBrokerSle = ctx.view.read(keylet::loanBroker(loanBrokerID));
    if (!loanBrokerSle)
    {
        // This should be impossible
        // LCOV_EXCL_START
        JLOG(ctx.j.fatal()) << "LoanBroker does not exist.";
        return tefBAD_LEDGER;
        // LCOV_EXCL_STOP
    }
    auto const vaultID = loanBrokerSle->at(sfVaultID);
    auto const vaultSle = ctx.view.read(keylet::vault(vaultID));
    if (!vaultSle)
    {
        // This should be impossible
        // LCOV_EXCL_START
        JLOG(ctx.j.fatal()) << "Vault does not exist.";
        return tefBAD_LEDGER;
        // LCOV_EXCL_STOP
    }
    auto const asset = vaultSle->at(sfAsset);
    auto const vaultPseudoAccount = vaultSle->at(sfAccount);
 
    if (amount.asset() != asset)
    {
        JLOG(ctx.j.warn()) << "Loan amount does not match the Vault asset.";
        return tecWRONG_ASSET;
    }
 
    if (auto const ret = checkFrozen(ctx.view, account, asset))
    {
        JLOG(ctx.j.warn()) << "Borrower account is frozen.";
        return ret;
    }
    if (auto const ret = checkDeepFrozen(ctx.view, vaultPseudoAccount, asset))
    {
        JLOG(ctx.j.warn()) << "Vault pseudo-account can not receive funds (deep frozen).";
        return ret;
    }
    if (auto const ret = requireAuth(ctx.view, asset, account))
    {
        JLOG(ctx.j.warn()) << "Borrower account is not authorized.";
        return ret;
    }
    // Make sure the borrower has enough funds to make the payment!
    // Do not support "partial payments" - if the transaction says to pay X,
    // then the account must have X available, even if the loan payment takes
    // less.
    if (auto const balance = accountHolds(
            ctx.view,
            account,
            asset,
            FreezeHandling::ZeroIfFrozen,
            AuthHandling::ZeroIfUnauthorized,
            ctx.j,
            SpendableHandling::FullBalance);
        balance < amount)
    {
        JLOG(ctx.j.warn()) << "Payment amount too large. Amount: " << to_string(amount.getJson())
                           << ". Balance: " << to_string(balance.getJson());
        return tecINSUFFICIENT_FUNDS;
    }
 
    return tesSUCCESS;
}
 
TER
LoanPay::doApply()
{
    auto const& tx = ctx_.tx;
    auto& view = ctx_.view();
 
    auto const amount = tx[sfAmount];
 
    auto const loanID = tx[sfLoanID];
    auto const loanSle = view.peek(keylet::loan(loanID));
    if (!loanSle)
        return tefBAD_LEDGER;  // LCOV_EXCL_LINE
    std::int32_t const loanScale = loanSle->at(sfLoanScale);
 
    auto const brokerID = loanSle->at(sfLoanBrokerID);
    auto const brokerSle = view.peek(keylet::loanBroker(brokerID));
    if (!brokerSle)
        return tefBAD_LEDGER;  // LCOV_EXCL_LINE
    auto const brokerOwner = brokerSle->at(sfOwner);
    auto const brokerPseudoAccount = brokerSle->at(sfAccount);
    auto const vaultID = brokerSle->at(sfVaultID);
    auto const vaultSle = view.peek(keylet::vault(vaultID));
    if (!vaultSle)
        return tefBAD_LEDGER;  // LCOV_EXCL_LINE
    auto const vaultPseudoAccount = vaultSle->at(sfAccount);
    auto const asset = *vaultSle->at(sfAsset);
 
    // Determine where to send the broker's fee
    auto coverAvailableProxy = brokerSle->at(sfCoverAvailable);
    TenthBips32 const coverRateMinimum{brokerSle->at(sfCoverRateMinimum)};
    auto debtTotalProxy = brokerSle->at(sfDebtTotal);
 
    auto const vaultScale = getAssetsTotalScale(vaultSle);
 
    // Send the broker fee to the owner if they have sufficient cover available,
    // _and_ if the owner can receive funds
    // _and_ if the broker is authorized to hold funds. If not, so as not to
    // block the payment, add it to the cover balance (send it to the broker
    // pseudo account).
    //
    // Normally freeze status is checked in preclaim, but we do it here to
    // avoid duplicating the check. It'll claim a fee either way.
    bool const sendBrokerFeeToOwner = [&]() {
        // In the fixCleanup3_2_0 path, vault-related values (for example,
        // DebtTotal) use vaultScale. The legacy path below intentionally retains
        // its pre-amendment loanScale behavior.
        auto const minCover = [&]() {
            if (view.rules().enabled(fixCleanup3_2_0))
            {
                return minimumBrokerCover(debtTotalProxy.value(), coverRateMinimum, vaultSle);
            }
            // Round the minimum required cover up to be conservative. This ensures
            // CoverAvailable never drops below the theoretical minimum, protecting
            // the broker's solvency.
            NumberRoundModeGuard const mg(Number::RoundingMode::Upward);
            return roundToAsset(
                asset, tenthBipsOfValue(debtTotalProxy.value(), coverRateMinimum), loanScale);
        }();
        return coverAvailableProxy >= minCover && !isDeepFrozen(view, brokerOwner, asset) &&
            !requireAuth(view, asset, brokerOwner, AuthType::StrongAuth);
    }();
 
    auto const brokerPayee = sendBrokerFeeToOwner ? brokerOwner : brokerPseudoAccount;
    auto const brokerPayeeSle = view.peek(keylet::account(brokerPayee));
    if (!sendBrokerFeeToOwner)
    {
        // If we can't send the fee to the owner, and the pseudo-account is
        // frozen, then we have to fail the payment.
        if (auto const ret = checkDeepFrozen(view, brokerPayee, asset))
        {
            JLOG(j_.warn()) << "Both Loan Broker and Loan Broker pseudo-account "
                               "can not receive funds (deep frozen).";
            return ret;
        }
    }
 
    //------------------------------------------------------
    // Loan object state changes
 
    // Unimpair the loan if it was impaired. Do this before the payment is
    // attempted, so the original values can be used. If the payment fails, this
    // change will be discarded.
    if (loanSle->isFlag(lsfLoanImpaired))
    {
        if (auto const ret = LoanManage::unimpairLoan(view, loanSle, vaultSle, asset, j_))
        {
            JLOG(j_.fatal()) << "Failed to unimpair loan before payment.";
            return ret;  // LCOV_EXCL_LINE
        }
    }
 
    LoanPaymentType const paymentType = [&tx]() {
        // preflight already checked that at most one flag is set.
        if (tx.isFlag(tfLoanLatePayment))
            return LoanPaymentType::Late;
        if (tx.isFlag(tfLoanFullPayment))
            return LoanPaymentType::Full;
        if (tx.isFlag(tfLoanOverpayment))
            return LoanPaymentType::Overpayment;
        return LoanPaymentType::Regular;
    }();
 
    std::expected<LoanPaymentParts, TER> const paymentParts =
        loanMakePayment(asset, view, loanSle, brokerSle, amount, paymentType, j_);
 
    if (!paymentParts)
    {
        XRPL_ASSERT_PARTS(
            paymentParts.error(), "xrpl::LoanPay::doApply", "payment error is an error");
        return paymentParts.error();
    }
 
    // If the payment computation completed without error, the loanSle object
    // has been modified.
    view.update(loanSle);
 
    XRPL_ASSERT_PARTS(
        // It is possible to pay 0 principal
        paymentParts->principalPaid >= 0,
        "xrpl::LoanPay::doApply",
        "valid principal paid");
    XRPL_ASSERT_PARTS(
        // It is possible to pay 0 interest
        paymentParts->interestPaid >= 0,
        "xrpl::LoanPay::doApply",
        "valid interest paid");
    XRPL_ASSERT_PARTS(
        // It should not be possible to pay 0 total
        paymentParts->principalPaid + paymentParts->interestPaid > 0,
        "xrpl::LoanPay::doApply",
        "valid total paid");
    XRPL_ASSERT_PARTS(paymentParts->feePaid >= 0, "xrpl::LoanPay::doApply", "valid fee paid");
 
    if (paymentParts->principalPaid < 0 || paymentParts->interestPaid < 0 ||
        paymentParts->feePaid < 0)
    {
        // LCOV_EXCL_START
        JLOG(j_.fatal()) << "Loan payment computation returned invalid values.";
        return tecLIMIT_EXCEEDED;
        // LCOV_EXCL_STOP
    }
 
    auto const [assetsTotalDelta, debtTotalDelta] = loanPaymentDeltas(vaultSle, *paymentParts);
 
    JLOG(j_.debug()) << "Loan Pay: principal paid: " << paymentParts->principalPaid
                     << ", interest paid: " << paymentParts->interestPaid
                     << ", fee paid: " << paymentParts->feePaid
                     << ", assets total delta: " << assetsTotalDelta
                     << ", debt total delta: " << debtTotalDelta;
 
    //------------------------------------------------------
    // LoanBroker object state changes
    view.update(brokerSle);
 
    auto assetsAvailableProxy = vaultSle->at(sfAssetsAvailable);
    auto assetsTotalProxy = vaultSle->at(sfAssetsTotal);
 
    auto const totalPaidToVaultRaw = paymentParts->principalPaid + paymentParts->interestPaid;
    auto const totalPaidToVaultRounded =
        roundToAsset(asset, totalPaidToVaultRaw, vaultScale, Number::RoundingMode::Downward);
    XRPL_ASSERT_PARTS(
        !asset.integral() || totalPaidToVaultRaw == totalPaidToVaultRounded,
        "xrpl::LoanPay::doApply",
        "rounding does nothing for integral asset");
    auto const totalPaidToBroker = paymentParts->feePaid;
 
    XRPL_ASSERT_PARTS(
        (totalPaidToVaultRaw + totalPaidToBroker) ==
            (paymentParts->principalPaid + paymentParts->interestPaid + paymentParts->feePaid),
        "xrpl::LoanPay::doApply",
        "payments add up");
 
    // Decrease LoanBroker Debt by the amount paid, add the Loan value change
    // (which might be negative). debtTotalDelta may be negative, increasing the
    // debt
    XRPL_ASSERT_PARTS(
        isRounded(asset, debtTotalDelta, loanScale),
        "xrpl::LoanPay::doApply",
        "debtTotalDelta rounding good");
    // Despite our best efforts, it's possible for rounding errors to accumulate
    // in the loan broker's debt total. This is because the broker may have more
    // than one loan with significantly different scales.
    adjustImpreciseNumber(debtTotalProxy, -debtTotalDelta, asset, vaultScale);
 
    //------------------------------------------------------
    // Vault object state changes
    view.update(vaultSle);
 
    Number const assetsAvailableBefore = *assetsAvailableProxy;
    Number const assetsTotalBefore = *assetsTotalProxy;
#if !NDEBUG
    {
        Number const pseudoAccountBalanceBefore = accountHolds(
            view,
            vaultPseudoAccount,
            asset,
            FreezeHandling::IgnoreFreeze,
            AuthHandling::IgnoreAuth,
            j_);
 
        XRPL_ASSERT_PARTS(
            assetsAvailableBefore == pseudoAccountBalanceBefore,
            "xrpl::LoanPay::doApply",
            "vault pseudo balance agrees before");
    }
#endif
 
    assetsAvailableProxy += totalPaidToVaultRounded;
    assetsTotalProxy += assetsTotalDelta;
 
    XRPL_ASSERT_PARTS(
        *assetsAvailableProxy <= *assetsTotalProxy,
        "xrpl::LoanPay::doApply",
        "assets available must not be greater than assets outstanding");
 
    JLOG(j_.debug()) << "total paid to vault raw: " << totalPaidToVaultRaw
                     << ", total paid to vault rounded: " << totalPaidToVaultRounded
                     << ", total paid to broker: " << totalPaidToBroker
                     << ", amount from transaction: " << amount;
 
    // Move funds
    XRPL_ASSERT_PARTS(
        totalPaidToVaultRounded + totalPaidToBroker <= amount,
        "xrpl::LoanPay::doApply",
        "amount is sufficient");
 
    if (!sendBrokerFeeToOwner)
    {
        // If there is not enough first-loss capital, add the fee to First Loss
        // Cover Pool. Note that this moves the entire fee - it does not attempt
        // to split it. The broker can Withdraw it later if they want, or leave
        // it for future needs.
        coverAvailableProxy += totalPaidToBroker;
    }
 
    associateAsset(*loanSle, asset);
    associateAsset(*brokerSle, asset);
    associateAsset(*vaultSle, asset);
 
    // Duplicate some checks after rounding
    Number const assetsAvailableAfter = *assetsAvailableProxy;
    Number const assetsTotalAfter = *assetsTotalProxy;
 
    XRPL_ASSERT_PARTS(
        assetsAvailableAfter <= assetsTotalAfter,
        "xrpl::LoanPay::doApply",
        "assets available must not be greater than assets outstanding");
    if (assetsAvailableAfter == assetsAvailableBefore)
    {
        // An unchanged assetsAvailable indicates that the amount paid to the
        // vault was zero, or rounded to zero. That should be impossible, but I
        // can't rule it out for extreme edge cases, so fail gracefully if it
        // happens.
        //
        // LCOV_EXCL_START
        JLOG(j_.warn()) << "LoanPay: Vault assets available unchanged after rounding: "  //
                        << "Before: " << assetsAvailableBefore                           //
                        << ", After: " << assetsAvailableAfter;
        return tecPRECISION_LOSS;
        // LCOV_EXCL_STOP
    }
    if (assetsTotalDelta != beast::kZero && assetsTotalAfter == assetsTotalBefore)
    {
        // Non-zero assetsTotalDelta with an unchanged assetsTotal indicates that
        // the actual value change rounded to zero. That should be impossible, but
        // I can't rule it out for extreme edge cases, so fail gracefully if it
        // happens.
        //
        // LCOV_EXCL_START
        JLOG(j_.warn())
            << "LoanPay: Vault assets expected change, but unchanged after rounding: "  //
            << "Before: " << assetsTotalBefore                                          //
            << ", After: " << assetsTotalAfter                                          //
            << ", AssetsTotalDelta: " << assetsTotalDelta;
        return tecPRECISION_LOSS;
        // LCOV_EXCL_STOP
    }
    if (assetsTotalDelta == beast::kZero && assetsTotalAfter != assetsTotalBefore)
    {
        // A change in assetsTotal when there was no assetsTotalDelta indicates
        // that something really weird happened. That should be flat out
        // impossible.
        //
        // LCOV_EXCL_START
        JLOG(j_.fatal()) << "LoanPay: Vault assets changed unexpectedly after rounding: "  //
                         << "Before: " << assetsTotalBefore                                //
                         << ", After: " << assetsTotalAfter                                //
                         << ", AssetsTotalDelta: " << assetsTotalDelta;
        return tecINTERNAL;
        // LCOV_EXCL_STOP
    }
    if (assetsAvailableAfter > assetsTotalAfter)
    {
        // Assets available are not allowed to be larger than assets total.
        // LCOV_EXCL_START
        JLOG(j_.fatal()) << "LoanPay: Vault assets available must not be greater "
                            "than assets outstanding. Available: "
                         << assetsAvailableAfter << ", Total: " << assetsTotalAfter;
        return tecINTERNAL;
        // LCOV_EXCL_STOP
    }
 
    // These three values are used to check that funds are conserved after the transfers
    auto const accountBalanceBefore = conservationBalance(view, accountID_, asset, j_);
    auto const vaultBalanceBefore = accountID_ == vaultPseudoAccount
        ? STAmount{asset, 0}
        : conservationBalance(view, vaultPseudoAccount, asset, j_);
    auto const brokerBalanceBefore = accountID_ == brokerPayee
        ? STAmount{asset, 0}
        : conservationBalance(view, brokerPayee, asset, j_);
 
    // Only ledgers without the rule below reach these payee checks. Once it is in force
    // requireAuth can no longer reject a pseudo-account, so the whole block goes away with the
    // gate.
    bool const skipPayeeAuth = view.rules().enabled(fixCleanup3_4_0);
 
    if (!skipPayeeAuth && totalPaidToVaultRounded != beast::kZero)
    {
        if (auto const ter = requireAuth(view, asset, vaultPseudoAccount, AuthType::StrongAuth))
            return ter;
    }
 
    if (totalPaidToBroker != beast::kZero)
    {
        if (brokerPayee == accountID_)
        {
            // The broker may have deleted their holding. Recreate it if needed
            if (auto const ter = addEmptyHolding(
                    ctx_.getApplyViewContext(),
                    brokerPayee,
                    brokerPayeeSle->at(sfBalance).value().xrp(),
                    asset,
                    j_);
                ter && ter != tecDUPLICATE)
            {
                // ignore tecDUPLICATE. That means the holding already exists,
                // and is fine here
                return ter;
            }
        }
        if (!skipPayeeAuth)
        {
            if (auto const ter = requireAuth(view, asset, brokerPayee, AuthType::StrongAuth))
                return ter;
        }
    }
 
    if (auto const ter = accountSendMulti(
            view,
            accountID_,
            asset,
            {{vaultPseudoAccount, totalPaidToVaultRounded}, {brokerPayee, totalPaidToBroker}},
            j_,
            WaiveTransferFee::Yes))
        return ter;
 
#if !NDEBUG
    {
        Number const pseudoAccountBalanceAfter = accountHolds(
            view,
            vaultPseudoAccount,
            asset,
            FreezeHandling::IgnoreFreeze,
            AuthHandling::IgnoreAuth,
            j_);
        XRPL_ASSERT_PARTS(
            assetsAvailableAfter == pseudoAccountBalanceAfter,
            "xrpl::LoanPay::doApply",
            "vault pseudo balance agrees after");
    }
#endif
 
    // Check that funds are conserved
    auto const accountBalanceAfter = conservationBalance(view, accountID_, asset, j_);
    auto const vaultBalanceAfter = accountID_ == vaultPseudoAccount
        ? STAmount{asset, 0}
        : conservationBalance(view, vaultPseudoAccount, asset, j_);
    auto const brokerBalanceAfter = accountID_ == brokerPayee
        ? STAmount{asset, 0}
        : conservationBalance(view, brokerPayee, asset, j_);
    auto const balanceScale = [&]() {
        // Find a reasonable scale to use for the balance comparisons.
        //
        // First find the minimum and maximum exponent of all the non-zero balances, before and
        // after. If min and max are equal, use that value. If they are not, use "max + 1" to reduce
        // rounding discrepancies without making the result meaningless. Cap the scale at
        // STAmount::kMaxOffset, just in case the numbers are all very large.
        std::vector<int> exponents;
        exponents.reserve(6);
 
        for (auto const& a : {
                 accountBalanceBefore,
                 vaultBalanceBefore,
                 brokerBalanceBefore,
                 accountBalanceAfter,
                 vaultBalanceAfter,
                 brokerBalanceAfter,
             })
        {
            // Exclude zeroes
            if (a != beast::kZero)
                exponents.push_back(a.exponent());
        }
        if (exponents.empty())
        {
            UNREACHABLE("xrpl::LoanPay::doApply : all zeroes");
            return 0;
        }
        auto const [minItr, maxItr] = std::ranges::minmax_element(exponents);
        auto const min = *minItr;
        auto const max = *maxItr;
        JLOG(j_.trace()) << "Min scale: " << min << ", max scale: " << max;
        // IOU rounding can be interesting. We want all the balance checks to agree, but don't want
        // to round to such an extreme that it becomes meaningless.  e.g. Everything rounds to one
        // digit. So add 1 to the max (reducing the number of digits after the decimal point by 1)
        // if the scales are not already all the same.
        return std::min(min == max ? max : max + 1, STAmount::kMaxOffset);
    }();
 
    // No object changes are made below this point
    XRPL_ASSERT_PARTS(
        Number::getround() == Number::RoundingMode::ToNearest,
        "xrpl::LoanPay::doApply",
        "Number rounding ToNearest");
    NumberRoundModeGuard const mg(Number::RoundingMode::ToNearest);
 
    auto const accountBalanceBeforeRounded = roundToScale(accountBalanceBefore, balanceScale);
    auto const vaultBalanceBeforeRounded = roundToScale(vaultBalanceBefore, balanceScale);
    auto const brokerBalanceBeforeRounded = roundToScale(brokerBalanceBefore, balanceScale);
 
    auto const totalBalanceBefore = accountBalanceBefore + vaultBalanceBefore + brokerBalanceBefore;
    auto const totalBalanceBeforeRounded = roundToScale(totalBalanceBefore, balanceScale);
 
    JLOG(j_.trace()) << "Before: "  //
                     << "account " << Number(accountBalanceBeforeRounded) << " ("
                     << Number(accountBalanceBefore) << ")"
                     << ", vault " << Number(vaultBalanceBeforeRounded) << " ("
                     << Number(vaultBalanceBefore) << ")"
                     << ", broker " << Number(brokerBalanceBeforeRounded) << " ("
                     << Number(brokerBalanceBefore) << ")"
                     << ", total " << Number(totalBalanceBeforeRounded) << " ("
                     << Number(totalBalanceBefore) << ")";
 
    auto const accountBalanceAfterRounded = roundToScale(accountBalanceAfter, balanceScale);
    auto const vaultBalanceAfterRounded = roundToScale(vaultBalanceAfter, balanceScale);
    auto const brokerBalanceAfterRounded = roundToScale(brokerBalanceAfter, balanceScale);
 
    auto const totalBalanceAfter = accountBalanceAfter + vaultBalanceAfter + brokerBalanceAfter;
    auto const totalBalanceAfterRounded = roundToScale(totalBalanceAfter, balanceScale);
 
    JLOG(j_.trace()) << "After: "  //
                     << "account " << Number(accountBalanceAfterRounded) << " ("
                     << Number(accountBalanceAfter) << ")"
                     << ", vault " << Number(vaultBalanceAfterRounded) << " ("
                     << Number(vaultBalanceAfter) << ")"
                     << ", broker " << Number(brokerBalanceAfterRounded) << " ("
                     << Number(brokerBalanceAfter) << ")"
                     << ", total " << Number(totalBalanceAfterRounded) << " ("
                     << Number(totalBalanceAfter) << ")";
 
    auto const accountBalanceChange = accountBalanceAfter - accountBalanceBefore;
    auto const vaultBalanceChange = vaultBalanceAfter - vaultBalanceBefore;
    auto const brokerBalanceChange = brokerBalanceAfter - brokerBalanceBefore;
 
    auto const totalBalanceChange = accountBalanceChange + vaultBalanceChange + brokerBalanceChange;
    auto const totalBalanceChangeRounded = roundToScale(totalBalanceChange, balanceScale);
 
    JLOG(j_.trace()) << "Changes: "                                    //
                     << "account " << to_string(accountBalanceChange)  //
                     << ", vault " << to_string(vaultBalanceChange)    //
                     << ", broker " << to_string(brokerBalanceChange)  //
                     << ", total " << to_string(totalBalanceChangeRounded) << " ("
                     << Number(totalBalanceChange) << ")";
 
    bool const goodRounding = totalBalanceBeforeRounded == totalBalanceAfterRounded ||
        totalBalanceChangeRounded == beast::kZero;
    if (totalBalanceBeforeRounded != totalBalanceAfterRounded)
    {
        JLOG((goodRounding ? j_.debug() : j_.warn()))
            << "Total rounded balances don't match"
            << (totalBalanceChangeRounded == beast::kZero ? ", but total changes do" : "");
    }
    if (totalBalanceChangeRounded != beast::kZero)
    {
        JLOG((goodRounding ? j_.debug() : j_.warn()))
            << "Total balance changes don't match"
            << (totalBalanceBeforeRounded == totalBalanceAfterRounded ? ", but total balances do"
                                                                      : "");
    }
 
    // Rounding for IOUs can be weird, so check a few different ways to show
    // that funds are conserved.
    XRPL_ASSERT_PARTS(
        goodRounding, "xrpl::LoanPay::doApply", "funds are conserved (with rounding)");
 
    XRPL_ASSERT_PARTS(
        accountBalanceAfter < accountBalanceBefore || accountID_ == asset.getIssuer(),
        "xrpl::LoanPay::doApply",
        "account balance decreased");
    XRPL_ASSERT_PARTS(
        vaultBalanceAfter >= beast::kZero && brokerBalanceAfter >= beast::kZero,
        "xrpl::LoanPay::doApply",
        "non-negative vault and broker balances");
    XRPL_ASSERT_PARTS(
        vaultBalanceAfter >= vaultBalanceBefore,
        "xrpl::LoanPay::doApply",
        "vault balance did not decrease");
    XRPL_ASSERT_PARTS(
        brokerBalanceAfter >= brokerBalanceBefore,
        "xrpl::LoanPay::doApply",
        "broker balance did not decrease");
    XRPL_ASSERT_PARTS(
        vaultBalanceAfter > vaultBalanceBefore || brokerBalanceAfter > brokerBalanceBefore,
        "xrpl::LoanPay::doApply",
        "vault and/or broker balance increased");
 
    return tesSUCCESS;
}
 
void
LoanPay::visitInvariantEntry(bool, SLE::ConstRef, SLE::ConstRef)
{
    // No transaction-specific invariants yet (future work).
}
 
bool
LoanPay::finalizeInvariants(STTx const&, TER, XRPAmount, ReadView const&, beast::Journal const&)
{
    // No transaction-specific invariants yet (future work).
    return true;
}
 
//------------------------------------------------------------------------------
 
}  // namespace xrpl