Potential 99.5% loss in `emergencyWithdraw()` of two Yieldbox strategies

Attacker can prevent rewards from being issued to gauges for a given epoch in TapiocaOptionBroker

Tapioca Bar: Unusable Market Add Functions in Penrose Contract

all deposit and withdraw function in Convex and Curve nativeLP Strategy, apply slippage on internal pricing; which call real-time on chain price from Curve directly and subject to MEV

The twTAP multiplier can be compromised with manipulated deposits of low value cost and high duration

read-only reentrancy in Curve Eth pool can lead to funds being stolen from the Lido strategy

Anyone can execute certain functions that use cross chain messages and potentially cancel them with potential loss of funds.

rebalanceXChain() can be called by anyone specifying a extreme high slippage

Derby vault rebalance fails when exchange rate of protocol LP tokens decreases.

Yearn withdrawal can revert making it impossible to rebalance the Derby vault

maxTrainingDeposit can be trivially circumvented

Aave Liquidity Pools do not count towards rewards

DAI, USDT and USDC are assumed to have an 1 to 1 exchange rate in the Curve 3pool

C7e7eff - Ineffective remaining principal limit for buyer

Anyone can wipe complete state of any collateral at any point

Improper validations in Clearinghouse. possible to lock collateral NFT in contract.

Anyone can steal CryptoPunk during the deposit flow to WPunkGateway

Incorrect accounting in SyndicateRewardsProcessor results in any LP token holder being able to steal other LP tokens holder's ETH from the fees and MEV vault.

Giant pools can be drained due to weak vault authenticity check

Seller's ability to decrypt bids before reveal could result in a much higher clearing price than anticpated and make buyers distrust the system

Attacker may DOS auctions using invalid bid parameters

Incompatibility with fee-on-transfer/inflationary/deflationary/rebasing tokens, on both base tokens and quote tokens, with varying impacts

Protocol withdrawals of collateral can be unexpectedly locked if governance sets the `collateralFactorBps` to 0.

Chainlink oracle data feed is not sufficiently validated and can return stale `price`