A user cannot claim for multiple epochs on the same distribution

ArrakisMetaVault::setModule Malicious executor can drain the vault by calling withdraw after initializePosition

ArrakisMetaVaultPrivate::fund No slippage control on private vault deposit can cause unlimited loss to owner

`OCY_Convex_C::claimRewards` will trap extra rewards in the contract instead of transferring them to `OCT_YDL`

ZivoeRewards::depositReward anybody can reset remaining rewards duration

OCL_ZVE.sol::forwardYield relies on manipulable Uniswap V2 pool reserves leading to theft of funds

ZivoeYDL::distributeYield yield distribution is flash-loan manipulatable

Attacker can DoS OCL_ZVE contract by calling OCL_ZVE::forwardYield before nextYieldDistribution is initialized

OCL_ZVE::pushToLockerMulti will fail when the liquidity is not added exactly at UniV2 pool's ratio

OCC_Modular::applyCombine will round APR down

BBLeverage::buyCollateral Malicious operator can abuse _allowedBorrow approval on Big bang market

BBLiquidation/SGLLiquidation::_updateBorrowAndCollateralShare liquidator can bypass bad debt handling to ensure whole liquidation reward

BBLiquidation::_liquidateUser liquidator can bypass protocol fee on liquidation by returning returnedShare == borrowShare

BigBang/Singularity::_updateBorrowAndCollateralShare totalBorrow variable is never updated and breaks a few core mechanics

Market::_computeClosingFactor wrong collateralization calculation can cause liquidatee solvency to become worse

BaseTOFTReceiver::_toeComposeReceiver some compose calls are not authenticated

UsdoMarketReceiverModule::removeAssetReceiver msg_.externalData.marketHelper is unchecked enabling arbitrary market actions from magnetar

BBLeverage/SGLLeverage::sellCollateral excess asset stays in contract

Singularity::removeAsset share can become zero due to rounding down, and any user can be extracted some amount of asset

BBCommon::_accrue wrong value is used to prevent overflow

BBLeverage::sellCollateral is unusable due to wrong asset deposit attempt in YieldBox

Penrose::_depositFeesToTwTap can unexpectedly revert due to amount rounded down

BBLeverage::sellCollateral relies on outdated interface for leverageExecutor

BaseLeverageExecutor::_swapAndTransferToSender will return wrong amount if TOFT wrapping has fees

TOFTMarketReceiverModule::leverageUpReceiver Incorrect approval handling

OperationalStaking::rewardValidators Rewards distribution can be sandwiched to extract most of the rewards from honest validators

OperationalStaking::_unstake Delegators can bypass 28 days unstaking cooldown when enough rewards have accumulated

BlockSpecimenProofChain::submitBlockSpecimenProof Block specimen producer can greatly reduce session duration by submitting fake block specimen in the future

OperationalStaking::setValidatorAddress Validator can bypass validatorMaxStake threshold by setting address to an existing delegator

LibUbiquityPool::mintDollar/redeemDollar reliance on outdated TWAP oracle may be inefficient for preventing depeg

UbiquityPool::mintDollar/redeemDollar collateral depeg will encourage using UbiquityPool to swap for better collateral

LibUbiquityPool::mintDollar/redeemDollar reliance on arbitrarily short TWAP oracle may be inefficient for preventing depeg

LibTWAPOracle::update Providing large liquidity will manipulate TWAP, DOSing redeem of uADs

PMMPricing::sellBaseToken Trader can drain pool by removing all reserves on one side

GSPVault::adjustPrice A user can sandwich adjust price to extract some funds from the LPs

GPSFunding::buyShares First depositor inflation attack

LockingPositionDelegate::manageOwnedAndDelegated unchecked duplicate tokenId allow metaGovernance manipulation

Division by Zero in CvgRewards::_distributeCvgRewards leads to locked funds

A user which is the only $CVG locker for YS during a TDE, can steal rewards from other TDEs

CvgRewards::_checkpoints Timing Inaccuracy Causes Extended Lock Durations Beyond Expected Cycle

LockPositionService::increaseLockTime Incorrect Calculation Extends Lock Duration Beyond Intended Period

An agent wounded-healed-wounded during ROUNDS_TO_BE_WOUNDED_BEFORE_DEAD rounds can be unjustly killed

A participant with enough agents can force win while some opponents' agents are healing

Winning agent id may be uninitialized when game is over, locking grand prize

Weak randomness in _woundRequestFulfilled can be slightly manipulated

TOFT and USDO Modules Can Be Selfdestructed

Refund mechanism for failed cross-chain transactions does not work

`LidoEthStrategy._currentBalance` is subject to price manipulation, allows overborrowing and liquidations

Usage of `BalancerStrategy.updateCache` will cause single sided Loss, discount to Depositor and to OverBorrow from Singularity

Ability to steal user funds and increase collateral share infinitely in BigBang and Singularity

twAML::participate - reentrancy via _safeMint can be used to brick reward distribution

Tokens can be stolen from other users who have approved Magnetar

Accounted balance of GlpStrategy does not match withdrawable balance, allowing for attackers to steal unclaimed rewards

`totalCollateralShare` state variable not updated in `Singularity` market upon liquidation, resulting in an error on `addCollateral` with skim functionality

SGLLeverage/BigBang `buyCollateral` Can Be Exploited to Steal Asset Approvals & Collateral

`ARBTriCryptoOracle` is vulnerable to read-only reentrancy

all deposit and withdraw function in Convex and Curve nativeLP Strategy, apply slippage on internal pricing; which call real-time on chain price from Curve directly and subject to MEV

The twTAP multiplier can be compromised with manipulated deposits of low value cost and high duration

User can exercise oTAP options for 3 weeks from a 1 week lock

BigBang/Singularity::sellCollateral - Surplus of collateral with regards to repay amount is never returned to user

MagnetarMarketModule::_exitPositionAndRemoveCollateral - Impossible to exitPosition without unlocking tOlp

TapiocaOptionBroker::newEpoch - An epoch can be skipped leading for unclaimed tap to distribute to be lost

oTAP::participate - Call will always revert if msg.sender is approved but not owner

mTapiocaOFT can't be rebalanced because the Balancer in tapiocaz-audit calls swapETH() or swap() of the RouterETH but does not forward ether for the message fee

PartyB nonce is not incremented during liquidation and can lead to signature reuse

Price signature reuse in setSymbolsPrice can heavily influence liquidation outcome

A partyA/B can Dos own liquidation because liquidation relies on a nonced signature

A partyA liquidation may be impossible to conclude if UPNL for one quote exceeds partyB's allocated funds

Liquidator can get liquidation fee two times for the same quote

A party B can open a short position for a limit quote in a way which makes party A liquidatable

Liquidation of a partyB be stuck, definitely bricking allocated funds

Nonce for partyB is not correctly incremented in `lockQuote`

Pool deviation check in SimpleManager on rebalance can be bypassed

Lack of rebalance rate limiting allow operators to drain vaults

Min deposit protection during rebalancing can be bypassed if multiple fee tiers

ChainLinkOraclePivot uses the same heartbeat for both underlying feeds

Consecutive stale epochs may lead to incorrect redeeming of balanced vault shares

Leveraged trader with small collateral can create a riskless position until settlement

Malicious trader can bypass utilization buffer

A trader close to liquidation risks being liquidated by trying to reduce her position

Previous owner of a club can extract assets of a Footium escrow, through unrevoked approvals

A club with a crafted id can be used to mint free players from the academy

FootiumClub safeMint method is misleadingly unsafe and can lead to stuck NFTs

Claiming rewards may fail because transfer result is unchecked

claimTokens function can be sandwiched to steal rewards

Rounding error in storePriceAndRewards leads to loss of rewards

pushVaultAmounts can be called multiple times if in the right state

No slippage control on rebalanceXChain

sendFundsToVault can be called multiple times for the same chainID

Aave rewards are never distributed

User can call reducePosition with wrong strategyId and abuse LTV limits

User never receive the interest on lending to the protocol

Vault shares can be left in spell during withdrawInternal

Ichi vault LP oracle is vulnerable to price manipulation with flashloan

High slippage tolerance when swapping on uniswapV3 can lead to frontrunning

Any bounty payment can be blocked by a malicious user funding with an nft

Attacker can block funding for OngoingBounty if paymentTokenAddress is non-whitelisted

High disparity between prevBaseFee and block.basefee makes block stuffing possible

Attacker can take loan for Victim

Improper validations in Clearinghouse. possible to lock collateral NFT in contract.