User can evade `liquidation` by depositing the minimum of tokens and gain time to not be liquidated

Attacker Can Inflate LP Position Value To Create a Bad Debt Loan

Remove Liquidity has missing reserve1 DUST check, which can make reserve1 to be less than DUST

Incorrect Configuration for Curve read Re-entrancy checks

Rewards sent by destinationVault during withdrawal can be locked forever inside lmpVault

updateDebtReporting can be front run, putting all the loss on later withdrawals but taking the profit

queueNewRewards pulls in more reward token than expected leading to permanently stuck reward token

Rewards are stuck in LiquidationRow contract

Attacker Can Steal generated Profit & performance fees, due to attacker controlled totalSupply() usage in _collectFees

Wrong procedure of minting & staking in lmpVault leads to theft of all rewards

LMPVault is not ERC4626 compliant as maxDeposits will revert randomly due to insufficient checks in _convertToAssets function

Precision Loss