borrowing::liquidate - `lastEventTime` isn't updated after `calculateCumulativeRate` is called

`GlobalVariables` may be compromised, if there are concurrent in-flight messages

borrowing::depositTokens - `calculateCumulativeRate` is called after borrower has been added

borrowing::_withdraw - `lastEventTime` is updated before calling `calculateCumulativeRate`

Positions, which are using assets with large heartbeat may accrue bad debt

Exploiter can always bypass `LIQUIDATION_DISCOUNT` and always seize all collateral

Exploiter can force user into unhealthy condition and liquidate him

SuperPoolFactory

Under certain circumstances bad debt will cause first depositor to lose funds

Pool::liquidate()

`SuperPool` has a `togglePause` function, but lack `whenNotPaused` modifier

Liquidators won't have incentive to repay positions under some conditions

`SuperPool#convertToShares` violates ERC4626

Use can grief `SuperPool#reallocate` for USDT because it doesn't use `forceApprove`

Many cases `stEth::transferFrom` will transfer 1-2 less way, which would result in revert in consequent functions, because of not enough balance

Loss of funds when deposit flow uses `_ethTOeEth`, because deposit amount is not handled correctly

SophonFarming.sol

Malicious actor can use block stuffing to force staker into another cycle

`LenderCommitmentGroup_Smart.sol::burnSharesToWithdrawEarnings` steal previous depositors funds

TellerV2.sol

LenderCommitmentGroup_Smart.sol#liquidateDefaultedLoanWithIncentive()

LenderCommitmentGroup_Smart.sol

LenderCommitmentGroup_Smart.sol

LenderCommitmentGroup_Smart.sol#getCollateralRequiredForPrincipalAmount()

If `repayLoanCallback` address doesn't implement `repayLoanCallback` try/catch won't go into the catch and will revert the tx

Unchecked `transferFrom` value may lead to borrower falsy repaying loan

`LendderCommitmentGroup::_calculateCollateralTokensAmountEq` may be manipulated

LenderCommitmentGroup_Smart.sol#liquidateDefaultedLoanWithIncentive()

User can easily DoS `FlashRolloverLoan_G5` for USDT loans

__Ownable_init is missing in LenderCommitmentGroup_Smart and TellerV2

TellerV2.sol#lenderAcceptBid()

`FlashRolloverLoan_G5::_acceptCommitment` with `smartCommitmentAddress` uses wrong signature

LenderCommitmentGroup_Smart.sol#_generateTokenNameAndSymbol()

LenderCommitmentGroup_Smart.sol#__valueOfUnderlying()