FluidLocker.lock() & provideLiquidity() breach the “initial-phase distribution” invariant

Subsequent Cross‐Chain Borrows don’t Accrue interest on existing principal when borrowing the same Asset

First-borrow collateral check bypass in CoreRouter.borrow() allows attacker to steal funds

Repeated claimLend calls drain all LEND because lendAccrued is not reset

Wrong check in borrowWithInterest() allows users to borrow more then they supplied

Unbounded loops over userTierHistory allows history-flood DOS on Tier-boundary users