LenderCommitmentGroup_Smart can be tricked to account for not owned loans payments

Tokens that return false on failed transfer is not supported

Overflow in CollateralTracker allows minting shares for free

`_validatePositionList()` does not check for duplicate tokenIds, allowing attackers to bypass solvency checks

Auctioneer.auction always write to lotRouting[0]

IERC20.transfer wil fail for USDT

VaultZapper may fail to swap tokens because of wrong allowance check

PrincipalToken is not ERC-5095 compliant

A locked fighter can be transferred; leads to game server unable to commit transactions, and unstoppable fighters

Player can mint more fighter NFTs during claim of rewards by leveraging reentrancy on the `claimRewards() function `

Non-transferable `GameItems` can be transferred with `GameItems::safeBatchTransferFrom(...)`

Can mint NFT with the desired attributes by reverting transaction

Close position trader fee can be bypassing

Wrong price used to update updateGlobalPositionData in liquidate

OracleModule verifies even invalid Pyth network price against Chainlink price

CouncilMember.burn will mess up members balances

Destructing VestingEscrow implementation via delegatecall

Whitelised accounts can be forcefully DoSed from buying curveTokens during the presale

Unrestricted claiming of fees due to missing balance updates in `FeeSplitter`

Unauthorized Access to setCurves Function

onBalanceChange causes previously unclaimed rewards to be cleared

Malicious user can drain TrufVesting during initial release period

Time weighted average price is wrongly implemented