`totalSupply` is reduced by incorrect amount in revokeVestingSchedule function

user votes are reduced by Incorrect amount in `revokeVestingSchedule` function

airdrop amount is calculated using Incorrect total supplies in ITO

Attacker can nullify rewards in ZivoeRewards and ZivoeRewardsVesting

Adding liquidity in OCL_ZVE will always fail due to allowance assertion checks

forwardYield function can be sandwiched to make it distribute more yield than intended

A locked fighter can be transferred; leads to game server unable to commit transactions, and unstoppable fighters

Since you can reroll with a different fighterType than the NFT you own, you can reroll bypassing maxRerollsAllowed and reroll attributes based on a different fighterType

Players have complete freedom to customize the fighter NFT when calling `redeemMintPass` and can redeem fighters of types Dendroid and with rare attributes

Fighters cannot be minted after the initial generation due to uninitialized `numElements` mapping

Non-transferable `GameItems` can be transferred with `GameItems::safeBatchTransferFrom(...)`

Minter / Staker / Spender roles can never be revoked`..,

DoS in `MergingPool::claimRewards` function and potential DoS in `RankedBattle::claimNRN` function if called after a significant amount of rounds passed.

Fighter created by mintFromMergingPool can have arbitrary weight and element

An attacker can bypass the leverage position NFT locking mechanism

The settle feature will be broken if attacker arbitrarily transfer collateral tokens to the PerpetualAtlanticVaultLP

The peg stability module can be compromised by forcing lowerDepeg to revert.

Incorrect precision assumed from RdpxPriceOracle creates multiple issues related to value inflation/deflation

_curveSwap: getDpxEthPrice and getEthPrice is in wrong order

deposits with native ETH are not correctly handled in LMPVaultRouterBase

An attacker can steal all the rewards due to incorrect reward accounting

queueNewRewards function trying to pull more amount of rewards from liquidator

Tokens are not being transferred to swapper before swapping in LiquidationRow contract

Destination vault rewards should be claimed before every withdrawal in LMPVault

Chainlink’s latestRoundData might return stale or incorrect results

Attacker can lock user premium vault funds on collateral vault by calling triggerEndEpoch function during NullEpoch