Desynchronization of Cabal's internal accounting with actual staked INIT amounts leads to over-minting of sxINIT tokens

Unstaking from LP pools will cause underflow and lock user funds

Unstaking calculates user share at request time, ignoring slashing — leading to DoS and unfair distribution

Users Who Queue Withdrawal Before A Slashing Event Disadvantage Users Who Queue After And Eventually Leads To Loss Of Funds For Them

Attacker can partially DoS L1 operations in StakingManager by making huge number of deposits

Inconsistent State Restoration in `cancelWithdrawal` Function

Incorrect Balance Check in Validator Redelegation Process May Block Legitimate Rebalancing Operations

Unauthorized Reallocation in `NudgeCampaign::handleReallocation` and Reward Disruption Vulnerability in `NudgeCampaign::invalidateParticipations`

Contract deployment restriction can be bypassed

The operator can create a `NativeVault` that can be silently unslashable.

Changing the slashingHandler for NativeVaults will DoS slashing

The `refundAccount` is erroneously set to `msg.sender` instead of `tx.origin` when `refundAccount` specified as `address(0)`

Flashloan rollover doesn't work with USDT

Owner of a position can prevent liquidation due to the 'onERC721Received' callback

Repayments and liquidations can be forced to revert by an attacker that repays miniscule amount of shares

Since you can reroll with a different fighterType than the NFT you own, you can reroll bypassing maxRerollsAllowed and reroll attributes based on a different fighterType

Players have complete freedom to customize the fighter NFT when calling `redeemMintPass` and can redeem fighters of types Dendroid and with rare attributes

FighterFarm:: reroll won't work for nft id greator than 255 due to input limited to uint8

Can mint NFT with the desired attributes by reverting transaction

Constraints of dailyAllowanceReplenishTime and allowanceRemaining during mint() can be bypassed by using alias accounts & safeTransferFrom()

Fighter created by mintFromMergingPool can have arbitrary weight and element