USDC Rewards Will Not Accrue Due to Precision Loss in `rewardPerToken` Calculation

Uninitialized Fee Recipient Causes Liquidation Failures

Mistake in Debt Repayment Calculation Can Lead to Extra Costs or Liquidation

User can Steal Tokens from the Protocol Due to Incorrect Unit Subtraction in updateParticipation

Delegation Boost Not Usable by Delegatees

ZENO Token Redemption Returns Negligible USDC Amount Compared to Purchase Price

Incorrect decimal handling in `Auction::buy()` leads to massive overpayment for ZENO tokens

RAACNFT mint function receives funds to address(this) but has no way of withdrawing them

`BaseGauge` users can claim rewards without staking

Ineffective Time-Weighted Average Implementation in Fee Distribution

[H-2] Lack of Emergency Pause in `BaseGauge::stake` and `BaseGauge::withdraw

Timelock Controller Retains Canceled Proposals, Enabling Unauthorized Execution and severe Governance Voting manipulation.

Incorrect DebtToken totalSupply Scaling Breaks Interest Rate Calculations

Using balanceOf Instead of Voting Power

Owner Can Change Vote Results After Voting Ends by Updating Quorum Numbers for New proposals

Workingsupply would always be overwritten in boostcontroller.sol impacting reward calculations

Emergency revoke in RAACReleaseOrchestrator will freeze revoked RAAC tokens in orchestrator

Time-skew Attack in RWAGauge Weight Calculations Through Precision Gaming

RAACToken burns less tokens than expected when feeCollector is unset

Incorrect boost calculation in `BoostController#_calculateBoost()` can be exploited to gain an unfair advantage in reward distribution

Boost Delegation Doesn’t Work and Leaves Boost Power Unused

closeLiquidation within LendingPool does not allow partial repayments, which can cause massive losses to users within edge case

Emission rate can be manipulated

Missing TokenURI Function in RAACNFT contract Makes All NFTs Look the Same and Unusable

The calculation of `totalAssets()` could be wrong if `operatorFeeAmount` > 0, this can cause potential loss for the new depositors

Incorrect Logic in onlyOperator Modifier Leading to Denial-of-Service for Authorized Operators Across Critical Functions