Arbitrary from parameter in transferFrom allows unauthorized token transfers

Unlimited request assignment and lack of the mechanism to revoke worker permissions enables protocol-wide DoS attack via malicious worker

Incorrect initializer modifier in Vesting contract prevents proper initialization

Incorrect tick parameter in collectFees() function leads to loss of vesting position fees or possible complete protocol lockup

MergeTgt has no handling if TGT_TO_EXCHANGE is exceeded during the exchange period

Wrong refundExecutionFee in _handleReturn

Wrong index causes last depositor to always get execution fee refund if cancelFlow is called by keeper to cancel a withdrawal

Functions that rely on chainlink prices cannot be queried on avalanche due to sequencer uptime check.

Ineffective proposal threshold validation allows setting arbitrary high values

`SecondSwap_Marketplace` vesting listing order affects how much the vesting buyers can claim at a given step