Incorrect Logic in onlyOperator Modifier Leading to Denial-of-Service for Authorized Operators Across Critical Functions

Users can claim more that their actual allotment

Listing potential can not be purchased with discounted price

maxSellPercent can be buypassed by selling previously bought vestings at a later time

Incorrect listing type validation bypasses enforcement of minimum purchase amount

Malicious BLACKLISTER_ROLE can temporarily block burning mechanism blacklisting address(0)

There is no logic to call clawBack() in few base incentive contracts

TokenManager - Unlimited withdraw

Taker of bid offer will loss assets without any benefit if he calls the DeliveryPlace::settleAskMaker() for partial settlement.

Native token withdrawal fails until manually approved

`DeliveryPlace::settleAskTaker` Has Incorrect Access Control

Formulaic Error Rounds Down Causing Total Loss Of Funds For Bid Takers During Abort

Malicious user can drain protocol by bypassing `ASK` offer abortion validation in `Turbo` mode

The `DeliveryPlace::settleAskTaker()` function mistakenly uses `makerInfo.tokenAddress` to update the `TokenBalanceType.PointToken` in the `userTokenBalanceMap` mapping, leading to a critical error.

Token withdrawal fails until someone manually approves spending

The referral bonus can't be split correctly between the referrer and the authority referral

`_createTriple()` logic do not follow the intended design mentioned in documentation

Invalid validation allows users to unlock early

`executeWithdraw` may be blocked if any of the users are blacklisted from the `baseToken`

Withdrawals in AccountManager are prone to DOS attacks.

Attacker can make 0 value deposit() calls to deny user from redeeming or withdrawing collateral

Design flaw and mismanagement in vault licensing leads to double counting in collateral ratios and positions collateralized entirely with kerosine

Users can get their Kerosene stuck until TVL becomes greater than Dyad's supply

Unable to withdraw Kerosene from `vaultmanagerv2::withdraw` as it expects a `vault.oracle()` method which is missing in Kerosene vaults

Value of kerosene can be manipulated to force liquidate users

Incorrect deployment / missing contract will break functionality