LP share over-minting via missing fee term in _updateBin() composition fee accounting

Summary

DLMMPool's active-bin share-minting formula omits a fee term the upstream Trader Joe V2 codebase it forked from includes, understating the liquidity denominator and over-minting LP shares on imbalanced active-bin deposits that trigger a composition fee.

Root cause

binLiquidity should include the LP-retained portion of the composition fee (fees.sub(protocolCFees)) since that value stays in the bin's reserves - the deployed code omits it entirely, confirmed via a line-by-line diff against the audited upstream source.

Verification

Quantified via an exact numeric replica of the Solidity arithmetic across dozens of scenarios (deposit size, protocol fee share, fee tier, repeated attack cycles, passive bystander LPs) - the composition fee paid always exceeded the value of the extra shares minted. Independently re-verified with an Echidna fuzzing campaign against the real compiled bytecode: 100,213 transactions, 28 distinct call sequences, 0 profitable sequences found. Assessed honestly as Low/Informational, not oversold - a real, systemic accounting bug worth fixing, with no demonstrated fund-loss path despite extensive testing.

Verified against real source code, not live deployed on this chain.