ClearingHouseLiq::_finalizeSubaccount() does not check if the subaccount has lps

Description

ClearingHouseLiq::liquidateSubaccountImpl() can finalize an account, repaying the bad debt from insurance or socializing the account, depending on the amount of insurance available.

It checks that the account has no positive balances, otherwise it may receive insurance or be socialized in some assets, increase its health and then retrieve the positive balances.

However, it does not check if the subaccount has lps, which may be used to maliciously steal funds from insurance or via socialization of the debt.

This can be exploited as the healh of the lp position should be lower than the real worth of the pro-rata base and quote assets, due to how the geometric mean works, which means that even if ClearingHouseLiq::liquidateSubaccountImpl() requires the account to be unhealthy at the end, the attacker will still profit later by burning the lp for the underlying amounts.

Recommendation

In ClearingHouseLiq::_finalizeSubaccount(), revert if the subaccount has lp balances.

Status

Addressed in #38bbe76.