Can mint NFT with the desired attributes by reverting transaction

Fighter created by mintFromMergingPool can have arbitrary weight and element

Anyone can update the address of the Router in the DcntEth contract to any address they would like to set.

Missing access control on UTB:receiveFromBridge allows UTB swaps to be executed without spending bridge fees while bypassing fee/swap instruction signature verification

Reusing a SALT that has already been used for voting can allow a malicious proposal to pass and compromise the protocol.

Unauthorized Access to setCurves Function

If a user sets their curve token symbol as the default one plus the next token counter instance it will render the whole default naming functionality obsolete