Anyone can delay rewards distribution

`SymmVesting` contract fails to initialize

The user can send tokens to any address by using two bridge transfers, even when transfers are restricted.

Incorrect checking about Min/Max limit in `Launch`.`updateParticipation`

`AutoCompoundingPodLp`.`_getSwapAmt` always uses `r0` because `_pairedLpTokenToPodLp` uses incorrect tokens order

Users lose their borrow assets during removing leverage because of the incorrect calculation of remaining borrow amount.

Unbond fee is applied twice in `spTKNMinimalOracle` contract

Users will lose rewards when shares change during reward token pause period

`_protocolFees` can be applied multiple times in `AutoCompoundingPodLp` contract

Incorrect logic of process rewards in `AutoCompoundingPodLp` contract allows users to steal rewards from other users

Reward tokens could be locked in `VotingPool` contract

Open fee is overcharged in `_addLeveragePostCallback` function

`removeLeverage` function in `LeverageManager` contract might fail because of rounding down in shares calculation

Users can avoid paying close fee by setting `_podSwapAmtOutMin` high.

`endAuction` always reverts

Users can mint more `LeverageToken` by splitting a single large deposit into multiple smaller deposits.

Users can add just-in-time liquidity to steal coupons

Incorrect price handling in `BondOracleAdapter` contract

Incorrect handling of `marketRate` during redemption of leverage token

Precision loss in `redeemRate` calculation

Bid with high price effectively can end up with lower price

Imprecise slot size calculation will prevent auction completion.

USD token blacklisted attacker can get whole reserve tokens from protocol

A malicious depositor can manipulate the initial collateral level of pools

An attacker can steal assets of users who deposit through `joinBalancerAndPredeposit` function of `BalancerRouter` contract

Failed auctions will leave `bondToken` holders uncompensated.

A malicious leverage token holder could manipulate reserve token amount of the pool to prevent auctions from success

Incorrect handling of decimals of `marketRate` during token redemption