Missing Return Statement in `_getReserves` Function in `MagicLpAggregator` Contract

Whitelised accounts can be forcefully DoSed from buying curveTokens during the presale

Curves::_buyCurvesToken(), Excess of Eth received is not refunded back to the user.

Potential risk of using `swappedAmount` in case of swap error

Incorrect implementation of RecordParser.readKeyValue()

HexUtils.hexStringToBytes32() and HexUtils.hexToAddress() may return incorrect results

Can't pause or remove a minter

Prohibition to create private pools with the factory NFT

`Factory.create`: Predictability of pool address creates multiple issues.

Stuck ether when use function `stake` with empty `derivatives`(`derivativeCount` = 0)

DoS due to external call failure

Multiple accounts can have the same identity

Adding NFTS with AssociationType ORDERED or PRIMARY may cause overwriting

Protocol fees can be withdrawn multiple times in `Erc20Quest`

Possible scenario for Signature Replay Attack

Users may not claim Erc1155 rewards when the Quest has ended

attacker can prevent vesting for a very long time

attacker can steal RToken holders funds by performing reentrancy attack during redeem() function token transfers

Arbitrary transactions possible due to insufficient signature validation

Attacker can gain control of counterfactual wallet

Destruction of the `SmartAccount` implementation

methods used by EntryPoint has `onlyOwner` modifier

Stealing fund by applying reentrancy attack on `removeCollateral`, `startLiquidationAuction`, and `purchaseLiquidationAuctionNFT`

Borrowers may earn auction proceeds without filling the debt shortfall

Coding logic of the contract upgrading renders upgrading contracts impractical

Admin does not have to wait to call `lastResortTimelockOwnerClaimNFT()`

Liquidity providers may lose funds when adding liquidity

First depositor can break minting of shares

Rounding error in buyQuote might result in free tokens

Malicious user can steal all assets in BondNFT

reentrancy attack during mint() function in Position contract which can lead to removing of the other user's limit orders or stealing contract funds because initId is set low value

Centralization risks: owner can freeze withdraws and use timelock to steal all funds

Manager can get around min reserves check, draining all funds from Collateral.sol

`LPDA` price can underflow the price due to bad settings and potentially brick the contract

`saleReceiver` and `feeReceiver` can steal refunds after sale has ended

Editions should be checked if they are actually deployed from the legitimate Escher721Factory

ETH will get stuck if all NFTs do not get sold.

Sale contracts can be bricked if any other minter mints a token with an id that overlaps the sale

`CrossChainExecutor` contracts do not update the necessary states for failing transactions.

Pool address is not deterministic, the actual Pool address deployed may be different from the address computed in advance

Centralization risk: admin can with rug the project by removing asset and price manipulation on oracle.

User can redirect fees by using a proxy contract

evm_hooks ignores some important errors

`PostTxProcessing` can revert user transactions not interacting with Turnstile

Assets may be lost when calling unprotected `AutoPxGlp::compound` function

Deposit Feature Of The Vault Will Break If Update To A New Platform

BringUnusedETHBackIntoGiantPool can cause stuck ether funds in Giant Pool

Giant pools can be drained due to weak vault authenticity check

Incorrect checking in _assertUserHasEnoughGiantLPToClaimVaultLP

Freezing of funds - Hacker can prevent users withdraws in giant pools

Giant pools cannot receive ETH from vaults

Direct theft of buyers ETH funds.

Pool designed to be upgradeable but does not set owner, making it unupgradeable

Attacker may DOS auctions using invalid bid parameters