Inconsistent balance accounting in stETH deposits leads to DOS of core functions and reward loss

Same heartbeat for multiple price feeds is vulnerable

First Depositor Attack Leading to Complete Fund Theft in PortfolioToken Contract

Lack of Access Control in `AgentNftV2::addValidator()` Enables Unauthorized Validator Injection and Causes Reward Accounting Inconsistencies

Attacker can prevent user from executing application registered through `initFromToken()` in `AgentFactoryV4`.

No slippage protection during adding liquidity to uniswap

`amountOutMin` passed in as 0 in `AgentToken::_swapTax` leads to loss of funds due to slippage

ZENO Token Redemption Returns Negligible USDC Amount Compared to Purchase Price

Incorrect decimal handling in `Auction::buy()` leads to massive overpayment for ZENO tokens

Multiple issues from unnecessary balance increase calculation in DebtToken.mint

Reward manipulation vulnerability in StabilityPool

RToken's transfer function lead to loss of funds due to incorrect math

Users can borrow more assets than they have deposited as collateral

NFTs Get Permanently Locked in Stability Pool After Liquidation

Double Usage Index Scaling in StabilityPool Liquidation Inflates Required CRVUSD Balance

Ownership Parameter Mismatch in LendingPool’s Vault Withdrawal Logic

Attackers can double voting power and veToken amount by locking and increasing

Missing Boost Balance and other parameters Update in veRAACToken Functions. Incomplete Boost State Updates Result in Inaccurate Voting Power and Reward Distribution

Incorrect DebtToken totalSupply Scaling Breaks Interest Rate Calculations

LendingPool deposits do not work with CurveVault due to lack of funds

`RToken::calculateDustAmount` are incorrectly calculated, leading to not be able to transfer the accrued dust amount

balanceOf(address(this)) in StabilityPool causes reward distribution to be higher than it should be

Limited veRaac Token Supply Triggers DoS, Hampering Proper Governance Participation.

Incorrect Logic in onlyOperator Modifier Leading to Denial-of-Service for Authorized Operators Across Critical Functions

Incorrect sequence of AaveDIVAWrapper constructor parameters