Unbounded Stake/Unstake Operations Leading to Contract Denial-of-Service

Users Can Overwrite Existing Locks in veRAACToken Resulting in Permanent Loss of Funds

Double Usage Index Scaling in StabilityPool Liquidation Inflates Required CRVUSD Balance

Ownership Parameter Mismatch in LendingPool’s Vault Withdrawal Logic

There is no logic checking for RAACNFT price staleness before minting it

Misuse of Raw vs. Normalized Values in Utilization Rate Calculation

balanceOf(address(this)) in StabilityPool causes reward distribution to be higher than it should be

Late Reserve Index Update Causes Stale Interest Accrual

Impossible to rescue funds from `RToken` contract

`FeeCollector::updateFeeType` wrong fee share validation leads to impossible update for some fee types

Lack of Access Controls in `calculateCumulativeRate()` Enables Rate Manipulation