Attacker can drain all ETH from AuctionDemo when block.timestamp == auctionEndTime

USDD token supply can be changed at any point by any EOA account

The USDD.sol contract incurs losses in both DAI and USDD whenever it executes a UniswapV3 swap

Minting USDD tokens in exchange for DAI is impossible due to a broken oracle implementation

The `rebalance` function can be exploited to drain ALL the Collateral Assets (in a form of DAI profit)

Centralization risks: owner can freeze withdraws and use timelock to steal all funds

_validateRuntimeConfig checks are being bypassed in the NFTCollection.sol contract initialization