There is no refund mechanism in `ChakraSettlement.processCrossChainCallback` or `ChakraSettlementHandler.receive_cross_chain_callback` function

`ChakraSettlement.receive_cross_chain_msg` and `ChakraSettlement.receive_cross_chain_callback` functions do not ensure that receiving `ChakraSettlement` contract's `contract_chain_name` must match `to_chain` corresponding to respective `txid` input though

SettlementSignatureVerifier is missing check for duplicate validator signatures

In Starknet already processed messages can be re-submitted and by anyone

handler's `receive_cross_chain_callback()` will always set the tx_status to `SETTLED` on source chain & burn the tokens (MintBurn Mode) even when the msg fails on destination

Bio Protocol - `tokenURI` JSON injection

Users can avoid all deposit fees by depositing through the carousel queue and immediately relaying

Queued deposits can be trapped by a rogue depositing contract that reverts when in the queue

Re-enlisting in a rollover allows modification of other users' rollover amounts/delisting their rollovers

A slow response or a denial of service attack could prevent the resolution of a brief depeg

Carousel rollover queues can become clogged with small items

Pool tokens are susceptible to double use of an allowance

Rewards delay release could cause yields steal and loss

removeValidator() and removeMinter() may fail due to exceeding gas limit

frxETHMinter.depositEther may run out of gas, leading to lost ETH

_baseVestedAmount() and vestedAmount() Return Incorrect Historical Values

Reentrancy may allow an admin to steal funds

Incorrect handling of pricefeed.decimals()

Griefing attack on the Vaults is possible, withdrawing the winning side stakes

StakingRewards: recoverERC20() can be used as a backdoor by the owner to retrieve rewardsToken

System is Vulnerable to Downtime and has no Checks for it

Voters can burn large amounts of Ether by submitting votes with long reason strings

Delegators can Avoid Lock Commitments if they can Reliably get Themselves Blocked when Needed

Blocking Through Change of Blocklist Could Trap Tokens

Change of operators possible from old operators