Any free-fee attacker will permanently brick last-LP withdrawal and other delete-time cleanup for every depositor of an AMM, SingleAssetVault, or LoanBroker as DelegateSet is missing the isPseudoAccount guard on sfAuthorize and inserts an ltDELEGATE SLE into the pseudo-account ownerDir, causing deleteAMMTrustLines and analogous cleanup paths to abort with tecINTERNAL

Inactive vault owner will permanently lock 6 XRP per sponsored vault for any sponsor of `VaultCreate` because `SponsorshipTransfer{tfSponsorshipEnd}` is rejected by the `ValidVault` invariant and `tfSponsorshipReassign` is rejected by the owner-of-record permission check

Any attestor will permanently increment the destination bridge `door` account `OwnerCount` and wedge the bridge `account-create` claim-ID window for users of the destination bridge as the attestor will park `XChainAddAccountCreateAttestation` with a sponsor it controls and immediately submit `SponsorshipTransfer{tfSponsorshipEnd}`

An MPT issuer with non-zero TransferFee will permanently DoS every crossing OfferCreate for any CLOB taker of the MPT/asset book as a near-maxMPTokenAmount poison offer triggers an unhandled MPTAmount::mulRatio overflow in BookStep::execOffer that propagates as tecINTERNAL and leaves the offer in place

Compliance issuer (or whole-tx-type MPTokenIssuanceSet delegate) will brick all AMMs holding an MPT for every LP as toggling tfMPTClearCanTransfer flips lsfMPTCanTransfer on the issuance and MPTokenHelpers::canTransfer has no AMM/Vault/LoanBroker pseudo-account exemption