Possible DoS scenario when transferring vests to another address

Minting zero tokens when underlyingToken is not Ether in cashIn()

Accumulated ETH in the LamboVEthRouter will be irretrievable

SettlementSignatureVerifier is missing check for duplicate validator signatures

Unrevoked approvals allow NFT recovery by previous owner

The maximum number of generations is infinite

Number of entities in generation can surpass the 10k number

Griefing attack on seller's airdrop benefits

Wrong minting logic based on total token count across generations

Pause and unpause functions are inaccessible

Discrepancy between nfts minted, price of nft when a generation changes & position of `_incrementGeneration()` inside `_mintInternal()` & `_mintNewEntity()`

Single plot can be occupied by multiple renters

Inability to perform partial liquidations allows huge positions to accrue bad debt in the system

The `BURNER` cannot burn tokens from accounts not KYC verified due to the check in `_beforeTokenTransfer`.

PrincipalToken is not ERC-5095 compliant

Constraints of dailyAllowanceReplenishTime and allowanceRemaining during mint() can be bypassed by using alias accounts & safeTransferFrom()

Re-triggering the `canOffboard[term]` flag to bypass the DAO vote of the lending term offboarding mechanism

Attacker can drain all ETH from AuctionDemo when block.timestamp == auctionEndTime

users still forced to follow previously set cooldownDuration even when cooldown is off (set to zero) before unstaking

Soft Restricted Staker Role can withdraw stUSDe for USDe

Users can fund pool without sending fees to the treasury

`RemoteAddressValidator` can incorrectly convert addresses to lower case

Calling `ExpiringMarket.stop` and `ExpiringMarket.isClosed` functions cannot pause any functionlities of the market