`Lock::_notifyreward()` Malicious users use Lightning Loans to quickly accumulate rewarding tokens `reward.cumulatedreward` . In the end, the reward of the user cannot withdraw the reward

`PositionMarginProcess::updateAllPositionFromBalanceMargin()` error, users can update `position.initialMarginInUsdFromBalance` in all positions by depositing a small amount of funds

`AccountFacet::batchUpdateAccountToken()` lacks calling permission. Anyone can call this method to add any number of tokens to the account.

`Edition::mintBatch()-0x904868b2`, the attacker can mint token for free

`Edition::mint()` does not check and process user input, `_refundExcess()` is invalid, and an attacker can tail the transaction and consume the ETH in the contract to mint tokens for free

`Edition::mintBatch()-0x1f7fdffa` design error, batch minting tokens does not work as expected

liquidity providers can maliciously burn tokens, causing the final result of `ZivoeITO::claimAirdrop()` to deviate significantly from expectations.

Every time you call `ZivoeRewards::depositReward()` to deposit a reward, after the reward is vested, there will almost always be some dust left behind, and the amount will expand infinitely.

Anyone can call `ZivoeRewardsVesting::depositReward()` to deposit the corresponding token, lower the `rewardRate` and postpone `periodFinish` indefinitely

`Auctioneer::auction()` using wrong lotId value to get `Routing storage routing` failed to save data as expected.

Calling `AuctionHouse::claimProceeds()` will modify `Auction.Status`, causing `AuctionHouse::claimBids()` to revert and the buyer cannot withdraw the token.

Repeated calculation of `routing.funding` resulted in `AuctionHouse::claimProceeds()::prefundingRefund` error, and the seller could not normally get the proceeds (quote tokens) and refund (base tokens)

Attackers can lock market funds, prevent normal execution of transactions, and steal funds in the maker

Infinite Minting `PointsModule::FMP`

`JUSDBankStorage::getTRate()`,`JUSDBankStorage::accrueRate()` are calculated differently, and the data calculation is biased, Causes the `JUSDBank` contract funciton result to be incorrect