Unauthorized Reallocation in `NudgeCampaign::handleReallocation` and Reward Disruption Vulnerability in `NudgeCampaign::invalidateParticipations`

Precision lost in `DebitaIncentives.claimIncentives()` will missing rewards for users with smaller lending/borrow activities

Borrow Order collateral issue: previous manager of `Receipt-veNFT` still have "Manager" access to grief lender

Anyone can delete same order twice will also delete other user orders

`PoolV3#repayCreditAccount()` use incorrect share converting function to calculate profit and loss

Risk of Overpayment Due to Race Condition Between repay and liquidateWithReplacement Transactions

Users won't liquidate positions because the logic used to calculate the liquidator's profit is incorrect

Sandwich attack on loan fulfillment will temporarily prevent users from accessing their borrowed funds

Size uses wrong source to query available liquidity on Aave, resulting in borrow and lend operations being bricked upon mainnet deployment

Multicall does not work as intended

LiquidateWithReplacement does not charge swap fees on the borrower

A Vault can steal all funds from another Vault through the Registry's flash loan contract due to insufficient access control in `Connector.sendTokensToTrustedAddress()`

`executeWithdraw` may be blocked if any of the users are blacklisted from the `baseToken`

`NoyaValueOracle.getValue` returns an incorrect price when a multi-token route is used

CompoundConnector.sol misses unclaimed rewards in getPositionTVL, resulting in undervalued positionTVL/TVL

First depositor can make subsequent depositor lose all of her or his deposit

Incorrect modifier condition

Stale price can be used in `getValueFromChainlinkFeed` function

Balancer flashloan contract can be DOSed completely by sending 1 wei to it

`depositQueue.queue` in `AccountingManager` can be flooded causing a DoS

No function to claim the reward in `PancakeswapConnector`.

Attacker can make 0 value deposit() calls to deny user from redeeming or withdrawing collateral

Design flaw and mismanagement in vault licensing leads to double counting in collateral ratios and positions collateralized entirely with kerosine

Kerosene collateral is not being moved on liquidation, exposing liquidators to loss

Users can get their Kerosene stuck until TVL becomes greater than Dyad's supply

Attacker can frontrun to prevent vaults from being removed from the dNFT owner's position

Value of kerosene can be manipulated to force liquidate users

setUnboundedKerosineVault not called during deployment, causing reverts when querying for Kerosene value after adding it as a Kerosene vault

`V3Vault.sol` permit signature does not check receiving token address is USDC

Malicious user can stake an amount which causes zero curStakeAtRisk on a loss but equal rewardPoints to a fair user on a win

Since you can reroll with a different fighterType than the NFT you own, you can reroll bypassing maxRerollsAllowed and reroll attributes based on a different fighterType

Players have complete freedom to customize the fighter NFT when calling `redeemMintPass` and can redeem fighters of types Dendroid and with rare attributes

Fighters cannot be minted after the initial generation due to uninitialized `numElements` mapping

NFTs can be transferred even if StakeAtRisk remains, so the user's win cannot be recorded on the chain due to underflow, and can recover past losses that can't be recovered(steal protocol's token)

Can mint NFT with the desired attributes by reverting transaction

Constraints of dailyAllowanceReplenishTime and allowanceRemaining during mint() can be bypassed by using alias accounts & safeTransferFrom()

DoS in `MergingPool::claimRewards` function and potential DoS in `RankedBattle::claimNRN` function if called after a significant amount of rounds passed.

Attacker can take advantage of Chainlink price not occuring within it's 60 minute heartbeat to make PriceAggregator calls fail

`StakingRewardsManager.sol` function `topUp()` does not use array index or `indices` to setup config

Burn `CouncilMember` NFT mixed up rewards balance of other NFT members. Causing wrong rewards to user

`TrufVesting` migration forget to move rewards from `VirtualStakingRewards` along to new address if user really lost their private keys

Attacker can drain all ETH from AuctionDemo when block.timestamp == auctionEndTime

Attacker can reenter to mint all the collection supply

Adversary can block `claimAuction()` due to push-strategy to transfer assets to multiple bidders

On a Linear or Exponential Descending Sale Model, a user that mint on the last `block.timestamp` mint at an unexpected price.

The RandomizerVRF and RandomizerRNG not produce hash value.

Artist signatures can be forged to impersonate the artist behind a collection

Borrower can drain all funds of a sanctioned lender

`Registry.sol` generate clone `Anchor.sol` never work. Profile owner cannot use their `Anchor` wallet

Underflow in updateTranscoderWithFees can cause corrupted data and loss of winning tickets.

Everyone can mint infinity amount of VoteToken/GovernanceToken for free

`LMPVaultRouterBase` mint and deposit function unintended pulling WETH from user when using only ETH

Steal TOKE reward by transfering `LMPVault` token to another address

forget apply `onlyBalancer` modifier to `mintRebalancer()` in `UUSD.sol`. Allowing arbitrage attack steal entire pool and collateral when rebalancing

Exploitation of `getSupplyProportion()`: Using Uniswap Flashloan to force `USSDRebalancer.sol` Pool/Collateral Swap and Subsequent Fund Thefts

UniswapV3 Tick Position Used to Manipulate USSD/DAI Pool Price

`amountToBuyLeftUSD` always return 0. `USSDRebalancer.sol` cannot buy collateral tokens

Chainlink oracle issues: stale, heartbeat, minAnswer price, zero price

`MarginTrading.sol` Lacks Permission Check, Exposing Funds to Theft

FeeWrapper fails to handle ETH payment refunds

Use of `block.number` leads to incorrect interest calculations

DOS `_mintShare()` using Openzeppelin ERC1155 `_mint` callback

`enlistInRollover()` for same user second time store the wrong index and broke roll over queue if delist right after

User can bypass treasury tax

`mintRollovers()` give wrong amount of share/assets to user

Faulty set `whiteListAddress` if using same treasury address twice

H- 1 wei ERC4626

Claimable amount for all locked capital in a lending pool only return latest snapshot and wrong total claimable amount

Malicious governance can use `updateWethTranferGas` to steal WETH from buyers

ETH mistakenly sent over with ERC20 based takeOrders and takeMultipleOneOrders calls will be lost

`VE3DRewardPool` and `VE3DLocker` adds to an unbounded array which may potentially lock all rewards in the contract

`VE3DRewardPool` claim in loop depend on pausable token

Unable To Get Rewards If Admin Withdraws $VE3D tokens From `VeTokenMinter` Contract

Misconfiguration of Fees Incentive Might Cause Tokens To Be Stuck In `Booster` Contract

First depositor can break minting of shares

Use `safeTransfer()`/`safeTransferFrom()` instead of `transfer()`/`transferFrom()`

Expiration calculation overflows if call option duration ≥ 195 days

It shouldn’t be possible to create a vault with Cally’ own token

Vault is Not Compatible with Fee Tokens and Vaults with Such Tokens Could Be Exploited

User's may accidentally overpay in `buyOption()` and the excess will be paid to the vault creator

safeTransferFrom is recommended instead of transfer (1)

amount requires to be updated to contract balance increase (1)

ERC20 tokens with different decimals than 18 leads to loss of funds

Use of `.send()` May Revert if The Recipient's Fallback Function Consumes More Than 2300 Gas

IERC20.transfer does not support all ERC20 token

First xERC4626 deposit exploit can break share calculation

StakedCitadel depositors can be attacked by the first depositor with depressing of vault token denomination

StakedCitadel doesn't use correct balance for internal accounting

StakedCitadel: wrong setupVesting function name

[WP-H7] Infinite approval to an arbitrary address can be used to steal all the funds from the contract

Anyone can get swaps for free given certain conditions in `swap`.

`msg.value` is Sent Multipletimes When Performing a Swap