Use `msg.sender` instead of `tx.origin`

Did not approve to zero first

Formulaic Error Rounds Down Causing Total Loss Of Funds For Bid Takers During Abort

Rounding Discrepancies in Deposit Amount Calculations

PreMarkets - Unable to withdraw platform rewards

Slippage protection is invalid

Users may be unable to execute the `swap()`

PufETHAdapter is unable to stake

Missing checks for staking limit

Front-running repayments to steal rewards from the protocol

If repayment fails, the lender may lose funds

Stealing principal tokens from the protocol

Burning shares first, then calculating the token to withdraw, results in users receiving more tokens

The calculated value for slippage protection in the protocol is inaccurate

Malicious users can deposit 0 assets to prolong the reward end time

The auction data of the first participant can be arbitrarily modified

Arbitrage can be conducted using the different prices returned by the Oracle

The deposit() and withdraw() functions lack slippage protection

When the epoch is rebalanced multiple times, users will experience a loss of funds when claiming

The calculation of `availableShares` is incorrect

When excess assets are rebalanced, the protocol may fail to execute

Users are unable to cast votes

Front-run attack on `rewardValidators()`

If the NFT owner changes and there are still positions that have not been executed, it will result in financial losses for the user

Users can pay a small fee with a token to mint a large amount of points

Minting to users using `totalSupply()` as the NFT ID is incorrect

When migrating the owner users will lose their rewards

Looping over unbounded `pendingStakes` array can lead to permanent DoS and frozen funds

Fees are hardcoded to 3000 in ExactInputSingleParams

Users with Negligible TST Holdings Might Not Receive Their Share of EUROs Fees

doesn't follow the EIP standard

The calculation of `getStablePoolTokenPrice()` is incorrect

`getWeightedPoolTokenPrice()` wrongly assumes that all of the weighted pools uses totalSupply

Precision Loss in Reward Calculation Causes Protocol Malfunction and User Funds Lockup

The slippage protection in `_poolCvgSDT.exchange()` is ineffective and does not provide the intended safeguard

The price of rsEHT could be manipulated by the first staker

Lack of slippage control on LRTDepositPool.depositAsset

Unhandled DoS when access to Chainlik oracle is blocked

If the token id has been burned, the borrower will not be able to repay the loan

The borrower may be unable to repay a loan

Incorrect implementation of checking whether borrowing collateral exceeds the maximum allowed collateral limit

Possible DOS on deposit(), withdraw() and unstake() for BridgeReth, leading to user loss of funds

ETH cannot always be unstaked using Rocket Pool

If a winner is blacklisted on any of the tokens they can't receive their funds

Sandwich attack to steal all ERC-20 tokens in the Fees contract

Borrower can use Refinance to cancel auctions so they can extend their loan indefinitely

The `borrow` and `refinance` functions can be front-run by the pool lender to set high interest rates

Frontrun can get the full reward, no staking time required

staleCheckLatestRoundData() does not check the status of the Arbitrum sequencer in Chainlink feeds.

Lack of fallbacks for price feed oracle

Liquidators can be front-run to their loss

The debt interest always evaluating to zero

Chainlink latestRoundData can return stale or incorrect data

USSDRebalancer getOwnValuation() calculation may overflow

Pool price is extemely easy to manipulate

`mintRebalancer()` and `burnRebalancer()` functions lack access control, allowing anyone to call them

USSD.UniV3SwapInput executes swaps without slippage protection

Incorrect `DAIEthOracle` address, which results in the malfunctioning of the function.

Result of the calculation is zero when collateral token has precision of 8 decimals

Chainlink's latestRoundData return stale or incorrect result

Inaccurate collateral factor calculation due to missing collateral asset

The protocol doesn't check If Arbitrum sequencer is down in Chainlink feeds

Chainlink's reported answer can be being carried over and stale

Drain the funds from MarginTrading protocol

Use safeMint instead of mint for ERC721

Use safeTransfer() instead of transfer() for ERC20 transfers

The protocol does not return all of the rewards to user

The quotes from Curve may be subject to manipulation

AuraSpell executes swaps without slippage protection

Lack of deadline for uniswap AMM

getPrice() doesn't check If Arbitrum sequencer is down in Chainlink feeds

The protocol will not be able to add liquidity on the curve with another token with a balance.

Users can fail to closePositionFarm and lose their funds

Stealing funds from users

`FlashLoanLiquidate.JOJOFlashLoan` swap asset without any slippage protection

A bad actor can steal funds from users

Insufficient support for fee-on-transfer tokens

Owner can set higher protocol fees to get funds from lender

The `royaltyRecipient` could not be prepare to receive ether, making the `sell` to fail

Both buyAllAmountWithLeverage and sellAllAmountWithLeverage always revert

Staking, unstaking and rebalanceToWeight can be sandwiched (Mainly rETH deposit )

`WstEth` derivative assumes a ~1=1 peg of stETH to ETH

Price of sfrxEth derivative is calculated incorrectly

Division before multiplication truncate minOut and incurs heavy precision loss and result in insufficient slippage protection

DoS due to external call failure

Users can not purchase PTs and YTs with ETH

User will lose the target token

Use call() instead of transfer() on an address payable

Incorrect capacity calculation in BondBaseOSDA contract.

Users can update and delete others' queues at will

A bad actor can revert in the callback function, causing the protocol to fail to mint deposit.

Different percision may prevent users from depositing.

Does not consider that the difference in precision between loan token and collateral token may cause the user will be not able to borrow tokens.

The target threshold may be lower than the minimum threshold

The signerCount value is incorrect

Sandwich attack to exchange rate

Missing deadline checks allow pending transactions to be mailciously executed

If the protocol is in the blacklist, the user can still stake tokens and get reward

Users can get double rewards

Users are not able to claim rewards if interanl reward token or external reward token is removed from list

Liquidation may fail due to insufficient share

Missing checks for amount 0 when buy or renew protection resulting in a large amount of garbage data generated in the protocol

User's balance can be reused to submit a withdrawal request that breaks the logic of deposit and withdrawal

The lockCapital() can make the whole contract malfunction

When user withdraw assets from ICHI Vault ,if the actual amount to remove in the value is less than lpTakeAmt ,then the user will lose the liquidity

Fee on transfer token not supported

Protocol fees can be withdrawn multiple times in `Erc20Quest`

KYCRegistry is susceptible to signature replay attack.