Overpayment of native ETH is not refunded to buyer

Accumulated ETH fees of InfinityExchange cannot be retrieved

Calling `unstake()` can cause locked funds

fund lose or griefing in all order matching functions [matchOneToOneOrders(), matchOneToManyOrders(), matchOrders(), takeMultipleOneOrders(), takeOrders()] because condition (seller != buyer ) is not checked in any of them

Protocol fee rate can be arbitrarily modified by the owner and the new rate will apply to all existing orders

Rounding Issues In Certain Functions

Upgraded Q -> M from 104 [1656258768065]

First depositor can break minting of shares

Market expiry behaviour differs in implementation and documentation

FeeSplitter: No sanity check to prevent shareholder from being added twice.

NestedFactory: Ensure zero msg.value if transferring from user and inputToken is not ETH

FeeSplitter: Unbounded number of shareholders can cause DOS

isResolverCached() will always return false after removing operator

Ensure on-chain that cache is synced

NestedFactory: User can utilise accidentally sent ETH funds via processOutputOrders() / processInputAndOutputOrders()

tokenBalanceOfAddress of nftOwner becomes permanently incorrect after arbRestake

SherlockClaimManager: Incorrect amounts needed and paid for escalated claims

updateYieldStrategy will freeze some funds with the old Strategy if yieldStrategy fails to withdraw all the funds because of liquidity issues

A vault can be locked from MarketplaceZap and StakingZap

NFTXSimpleFeeDistributor#addReceiver: Failure to check for existing receiver

FeeSplitter: No sanity check to prevent shareholder from being added twice.

NestedFactory: Ensure zero msg.value if transferring from user and inputToken is not ETH

FeeSplitter: Unbounded number of shareholders can cause DOS

isResolverCached() will always return false after removing operator

Ensure on-chain that cache is synced

NestedFactory: User can utilise accidentally sent ETH funds via processOutputOrders() / processInputAndOutputOrders()

IndexPool: Poor conversion from Balancer V1's corresponding functions

ConstantProductPool & HybridPool: Adding and removing unbalanced liquidity yields slightly more tokens than swap