M-2 : Liquidator could fail to liquidate USDC Blacklisted

Challengers and bidders can collude together to restrict the minting of position owner

Users will be able to purchase fewer NFTs than the project had anticipated

Possible scenario for Signature Replay Attack

User may loose rewards if the receipt is minted after quest end time

Strategist can fail to withdraw asset token from a private vault

A user can use the same proof for a commitment more than 1 time

Source contract can steal NFTs from users

frxETHMinter: Non-conforming ERC20 tokens not recoverable

_baseVestedAmount() and vestedAmount() Return Incorrect Historical Values

Can Recover Gobblers Burnt In Legendary Mint

Multiple vote checkpoints per block will lead to incorrect vote accounting

Creating a new governance proposal can be prevented by anyone

In `Governance.sol`, it might be impossible to activate a new proposal forever after failed to execute the previous active proposal.

Voted votes cannot change after the user are issued with new votes or the user's old votes are revoked during voting

Protocol fee rate can be arbitrarily modified by the owner and the new rate will apply to all existing orders

Owner can set the feeRate to be greater than 100% and cause all future calls to `exercise` to revert

User's may accidentally overpay in `buyOption()` and the excess will be paid to the vault creator

Use of `.send()` May Revert if The Recipient's Fallback Function Consumes More Than 2300 Gas

StakedCitadel: wrong setupVesting function name

Funding.deposit() doesn't work if there is no discount set

ERC20 transferFrom return values not checked