Roles once assigned cannot be revoked.

Due to no access control on `DistributionV2::_authorizeUpgrade()` anyone can change the implementation contract and can destroy the main Proxy contract.

Any User can mint any amount of WStETH in the WStETHMock.sol and StETHMock.sol

Unauthorized Access to setCurves Function

Curves::_buyCurvesToken(), Excess of Eth received is not refunded back to the user.

Uncheck Arithmetic where overflow/underflow impossible

Use assembly to check for `address(0)`

Use if + custom errors instead of using require + string

Don't initialize `uint/int` variables with default value

Caching the pool variable for gas savings

`++i`/`i++` should be `unchecked{++i}`/`unchecked{i++}` when it is not possible for them to overflow, as is the case when used in `for`- and `while`-loops