The owner of an NFT position that got liquidated will continue to earn rewards based on the amount supplied and borrowed pre-liquidation

Not converting user collateral from shares to assets in LiquidationLogic

getDebtBalance does not convert shares to asset

_accrueToTreasury (interest fee) does not increment total supply

Malicious attacker can inflate interest rate to steal funds from borrowers with no cost

Attacker can continually steal all the interest earned by suppliers in the vault

Malicious pool deployer can set a malicious interest rate contract to lock funds of vault depositors

Anyone can reduce interest rate to effectively zero instantly

When bad debt is accumulated, the loss is not shared amongst all suppliers, instead the last to withdraw will experience a huge loss

An attacker can sandwich liquidations by borrowing the collateral to ensure the liquidation reverts

Repaying loans via NFT position manager will always revert. User collateral will be stuck forever.

Incorrect handling of allocation.assets=0 in CuratedVault.reallocate()

Inconsistent rounding of rayMul() leads to failed repayment of tokens

getAssetPrice stale price threshold of 1800 is too small, this makes the protocol unusable

executeMintToTreasury does not update interest rate

getAssetPrice does not account for the decimals returned by chainlink, an attacker can use this to steal supplied funds

A malicious attacker can frontrun and grief the deposit of the first depositor

By inflating the value of a pool share, a malicious actor can steal a large amount of funds

ChainlinkOracle does not check if the returned price is outside the min/max range for the token

Attacker can take advantage of high LTV tokens to create bad debt for the protocol

The RedstoneCoreOracle has a constant stale price threshold, this is dangerous to use with tokens that have a smaller threshold as the oracle will report stale prices as valid

SuperPool inherits pausable but none of the functions have the `whenNotPaused` modifier

`deploySuperPool` will revert if the asset is USDT

The `convertToShares()` function is not ERC 4626 compliant

Liquidation fee is incorrectly calculated, leading to unprofitable liquidations