Your question seems to be based on an incomplete understanding of the mechanics of how banks pursue loans when things go poorly. I'm saying this because of they way you described the situation here:
In a unlikely case of my friend not paying the car, I suppose the bank will use the lien and will sell the car first and will ask me to pay any difference or the bank will directly ask me to pay the installment.
Your "or" is actually what happens first. The bank won't pursue repossessing or selling the vehicle until they've exhausted all attempts at getting either of you to pay the loan off. And those attempts will cause a big hit to your credit score, regardless of what finally happens.
The normal way that the bank gets their money back is by your friend making regular payments. If your friend stops making payments, the bank will pursue both of you (individually) for repayment of the amount that is overdue. This is their first path - make the loan current by getting the overdue amount from either you. This generally happens well before the bank attempts to repossess the vehicle or charge off the loan. At this point, you and your friend will both take a hit to their credit score (for being late on a loan).
It's important to note that until the point at which the bank repossesses the vehicle, the amount the lender will try to collect is the full outstanding amount of the loan (plus any fees). They don't care if your friend has sold the vehicle or if the vehicle is worth a certain amount or not. In other words, their preferred outcome is that either of you pay them back the full amount of the loan, and they don't have to repossess the car.
If neither of you are able to bring the loan current, the lender will attempt to repossess the vehicle. Once they have possession of the vehicle, they will try to sell it as quickly as possible, which basically means it gets wholesaled at a very low price. Then, you and your friend will both be pursued for the difference (it's incredibly rare for a repossessed car to sell for enough to pay a loan back, especially because by the time repossession happens, there's usually a heap of late fees on top of the outstanding loan amount). Both of you will take a huge hit to your credit score again. If they can't get either of you to pay the difference, they will report the difference as a charged off amount against a defaulted loan. And once again, both of you take the hit to your credit score.
If your friend does stop making payments, and the lender comes after you, and you pay the loan off, you have zero leverage to recoup that money or get your friend to pay you back. Your friend owns the car, not you. Congrats, you just bought your friend a car.
An important point is that the lender has little obligation to communicate with the two of you in any sort of uniform manner. You will generally not get told the details of what your friend is, or is not, doing with respect to the loan. If things do go poorly and your friend isn't telling you, you will get a collections notice. This puts you in a very tenuous position, because you may find out on very short notice that you owe a large amount of money.
It's also important to point out that unless you talk your friend into putting your name on the title (which is rare), you have zero ownership or rights to the value of the vehicle. Your friend could sell it for whatever price they want, without telling you. They could total it. They could trade it to a meth dealer. If your friend defaults on the loan, and the bank can't find the car to repossess it, you have no way of forcing your friend to sell it as a way to get some of the debt paid back.
To sum this all up and make it very clear: Cosigning for a loan is an act of pure charity:
- You are taking on 100% of the responsibility with 0% of the benefit or value.
- You have no rights or ownership to the vehicle.
- You may find yourself on the hook for the full loan amount, with very short notice.
- You may also find yourself with a ruined credit score, on very short notice.
- You may wake up one day to a scary looking repo man knocking on your door asking you where the car is.
- Your ability to borrow for your own uses will be reduced, since the loan will show up as debt on your credit report.
- Your friend can do whatever they please, and you are left on the hook.
In case it isn't clear, you should not cosign a loan unless you are willing to be fully responsible for the entire loan amount, while receiving nothing in return.
To answer the question in your title,
cosign a car loan, what is true $ risk
The "true risk" is the full amount of the loan. You can't count on repossession reducing that risk, because many vehicles are never repossessed.