Triggering liquidations ahead of expected time leads to loss and lock of funds

Incorrect operator in `AstariaRouter.isValidRefinance` can lead to borrower loss and potential liquidation

Loans can exceed the maximum potential debt leading to vault insolvency and possible loss of LP funds

Payments and liquidations of multiple liens will revert and can be exploited, causing payer fund loss

Public vault depositors will receive fewer vault shares until the first payment

Epochs can be progressed during ongoing auctions to cause LP fund loss and collateral lockup

Anyone can deposit and mint withdrawal proxy shares to capture distributed yield from borrower interests

Auction bid that partially pays back an expired lien will revert

Lien buyout with new terms does not update the slope of public vaults

A malicious lien buyer can DoS to cause fund loss/lock

`VaultImplementation._validateCommitment` may prevent liens that satisfy their terms of `maxPotentialDebt`

Auctions with remaining liens will always revert causing loss of funds for the highest bidder and stuck collateral

A malicious lien owner can exploit a reentrancy to steal LP funds

`LiquidationAccountant.claim()` can be called by anyone causing vault insolvency

A payment made towards multiple liens causes the borrower to lose funds to the payee

Purchaser of a lien token may not receive payments

Lien count per epoch is not updated ultimately locking the collateralized NFT

`LienToken.buyoutLien` will always revert

Public vaults can become insolvent because of missing `yIntercept` update

Canceling an auction will result in a loss of borrower funds towards initiator fees

Canceling an auction with 0 bids will only partially pay back the outstanding debt

Canceling an auction does not refund the current highest bidder

`commitToLiens` always reverts

Loan duration can exceed the end of the next epoch

Buyouts of shorter duration liens can lead to the loss of borrower funds

Minting public vault shares while the protocol is paused can lead to LP fund loss

Incorrect calculation in `PublicVault.timeToEpochEnd()` causes loss of LP funds and lock of borrower collateral

Auctions run for less time than intended

Incorrect `LienToken.changeInSlope` calculation can lead to vault insolvency

Any excess payment by the borrower towards a lien is not refunded leading to a loss of borrower funds

`LienToken.createLien` may prevent liens that satisfy their terms of `maxPotentialDebt`

`AstariaRouter.commitToLiens` will revert if the protocol fee is enabled

Enforcing the maximum auction duration fails, leading in potential loss of funds to LPs

Extension logic incorrectly extends the auction by an additional amount of existing duration

Outstanding debt is not guaranteed to be covered by auctions

Unsafe handling of underlying tokens

Missing event & timelock for critical onlyAdmin functions

Admin is a single-point of failure without any mitigations

Previously created markets can be overwritten

Use of tokenB’s price instead of tokenA in determining account health will lead to protocol mis-accounting and insolvency

safeTransferFrom in TransferHelper is not safeTransferFrom

Chainlink - Use latestRoundData instead latestAnswer to run more validations

Use of deprecated Chainlink API

Incorrect data location specifier can be abused to cause DoS and fund loss

Unsafe approve would halt the auction and burn the bond

`_depositToBentoBox` sometimes uses both ETH and WETH

`PostAuctionLauncher.sol#finalize()` Adding liquidity to an existing pool may allows the attacker to steal most of the tokens

Controller does not raise an error when there's insufficient liquidity

No safety check in addToken

`Vault.withdraw` sometimes burns too many shares

Halting the protocol should be onlyGovernance and not onlyStrategist

manager.allowedVaults check missing for add/remove strategy

Missing events/timelocks for owner/admin only functions that change critical parameters

onlyOwnerOrAssetManager can swap Yield Source in SwappableYieldSource at any time, immediately rugging all funds from old yield source

SwappableYieldSource: Missing same deposit token check in transferFunds()

Single-step process for critical ownership transfer/renounce is risky

Use of safeApprove will always cause approveMax to revert

Members lose SPARTA tokens in removeLiquiditySingle()

Pool.sol & Synth.sol: Failing Max Value Allowance

Result of transfer / transferFrom not checked

Missleading onlyDAO modifiers

Improper access control of `claimAllForMember` allows anyone to reduce the weight of a member

BondVault.sol: Possibly unwithdrawable bondedLP funds in claimForMember() + claimRate never zeros after full withdrawals

Dao.sol: Insufficient validation for proposal creation

Router liquidity on receiving chain can be double-dipped by the user

Expired transfers will lock user funds on the sending chain

Anyone can arbitrarily add router liquidity

Signatures use only tx ID instead of entire digest

Use of tokenB’s price instead of tokenA in determining account health will lead to protocol mis-accounting and insolvency

safeTransferFrom in TransferHelper is not safeTransferFrom

Chainlink - Use latestRoundData instead latestAnswer to run more validations

Use of deprecated Chainlink API

Incorrect use of operator leads to arbitrary minting of GVT tokens

Usage of deprecated ChainLink API in `Buoy3Pool`

Safe addresses can only be added but not removed

Flash loan risk mitigation is optional and not robust enough

Use of incorrect index leads to incorrect updation of funding rates

Malicious owner can drain the market at any time using SafetyWithdraw

No check transferFrom() return value

Add reentracy protections on function `executeTrade`

Single-step process for critical ownership transfer

Malicious owner can arbitrarily change fee to any % value

Use of deprecated Chainlink API

`YearnV2YieldSource` wrong subtraction in withdraw

The assumption that operator == to (user) may not hold leading to failed timelock deposits

Actual yield source check on address will succeed for non-existent contract

safeApprove() for Yearn Vault may revert preventing deposits causing DoS

anyone can call function sponsor

Critical uberOwner address changes should be a two-step process

Deposit whitelist enforced on msg.sender instead of user

Missing call to removeOldBids may affect foreclosure

Missing balancedBooks modifier could result in failed system insolvency detection

NFT Hub implementation deviates from ERC721 for transfer functions

`RCNftHubL2.safeTransferFrom` not accoring to spec

RCFactory.createMarket() does not enforce _timestamps[1] and _timestamps[2] being larger than _timestamps[0], even though proper functioning requires them to be so

maxSumOfPrices check is broken

Flows can bypass market and global pause

Potential griefing with DoS by front-running vault creation with same vaultID

Uninitialized or Incorrectly set auctionInterval may lead to liquidation engine livelock

Violation of implicit constraints in batched operations may break protocol assumptions

Conviction scoring fails to initialize and bootstrap

Locked funds are debited twice from user during tokenization leading to fund loss

Locked funds from tokenization are credited twice to user leading to protocol fund loss

Incorrect use of _addTribute instead of _addGovernanceTribute

Call to swapExactTokensForETH in liquidateDai() will always fail

Conviction totals not updated during tokenization

NFTs can never be redeemed back to their conviction scores leading to lock/loss of funds

NFT transfer approvals are not removed and cannot be revoked thus leading to loss of NFT tokens

A previously timelocked NFT token becomes permanently stuck in vault if it’s ever moved back into the vault

Unhandled return value of transferFrom in timeLockERC20() could lead to fund loss for recipients

Randomization of NFTs returned in redeem/swap operations can be brute-forced

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

ERC-721 Enumerable Spec mismatch for index of tokenByIndex() function

Unhandled return value of transfer in transferOut() of Pools.sol

Flash attack mitigation does not work as intended in USDV.sol

Incorrect initialization causes VADER emission rate of 1 second instead of 1 day in Vader.sol

Missing DAO functionality to call changeDAO() function in Vader.sol

Flash loans can affect governance voting in DAO.sol

Incorrect burn address in Vader.sol

Wrong liquidity units calculation

Anyone can list anchors / curate tokens

Wrong `calcAsymmetricShare` calculation

Proposals can be cancelled

convert collects funds even when minting is disabled

Incorrect initialization gives IL protection of only 1 second instead of 100 days in Router.sol

Pool functions can be called before initialization in init() of Pools.sol

User may not get IL protection if certain functions are called directly in Pools.sol

Incorrect operator used in deploySynth() of Pools.sol

changeDAO should be a two-step process in Vader.sol

Init function can be called by everyone

Undefined behavior for DAO and GRANT vote proposals in DAO.sol

Copy-paste bug leading to incorrect harvest rewards in Vault.sol

Lack of input validation in replacePool() allows curated pool limit bypass in Router.sol