Possible lost msg.value

If `totalShares` for a token falls to zero while there is `pendingCredit` the contract will become stuck

Alchemist can mint `AlTokens` above their assigned ceiling by calling `lowerHasMinted()`

Lido adapter incorrectly calculates the price of the underlying token

DoS: Blacklisted user may prevent `withdrawExcessRewards()`

amount requires to be updated to contract balance increase (1)

Owner of a pool may prevent any taxes being withdrawn

DoS: Attacker may significantly increase the cost of `withdrawExcessRewards()` by creating a significant number of excess receipts

Centralisation Risk: Owner may abuse the tax rate to claim 99.9% of pools

Merkle leaves are the same length as the parents that are hashed

`MerkleDropFactory.depositTokens()` does not require the tree to exist

Contract may not have enough fund to cover refund

Critical variables shouldn't be changed after they are set

IERC20.transfer does not support all ERC20 token

Reentrancy at _requestLoan allows requesting a loan without supplying collateral

Existing user’s locked JPEG could be overwritten by new user, causing permanent loss of JPEG funds

Division before Multiplication May Result In No Interest Being Accrued

Can force borrower to pay huge interest