Bidder will lose all their funds if they place a bid and owner later cancels auction

Bidder can cheat auction by placing bid much higher than reserve price when there are still open liens against a token

Collateral will still have unpaid liens after cancelAuction if initiatorFee != 0

WithdrawProxy.sol exchange rate can be abused to steal all funds from withdrawing LPs

Attacker can permanently break PublicVault.sol#processEpoch by calling deposit on withdrawProxy.sol

LiquidationAccountant.sol#claim is an unprotected function and can lead to a stale withdrawRatio used to distribute funds

_deleteLienPosition can be called by anyone to delete any lien they wish

createBid will revert for all calls if extended duration is greater than max duration

PublicVault.sol doesn't override ERC4626Cloned.sol#mint allowing users to bypass router control of depositing

_makePayment is logically inconsistent with how lien stack is managed causing payments to multiple liens to fail

UserManger#cancelVouch incomplete logic mixes up index after vouch is removed