Insolvency via Cross-Service Reentrancy in StakingBase._withdraw

Attacker will drain pooled liquidity from honest suppliers

Liquidity-layer fallback will lock payouts for MoneyMarket users

BuilderWallet `init()` is unprotected/re-initializable, enabling takeover and theft of builder fees

`RiskEngine::_getRequiredCollateralAtTickSinglePosition()` Fails to Accumulate Credits Across Multiple Legs, Leading to Potential Erroneous Liquidations

Incorrect `UPPER_118BITS_MASK` Mask in `OraclePackLibrary` Causes Unexpected Clearing of `EMAs` and `lockMode` in `OraclePack`

Division-by-zero in long-leg collateral requirement can block solvency checks and `dispatchFrom` (liquidation/force-exercise) for tickSpacing==1 pools

Liquidations Can Be Permanently Blocked via `getLiquidationBonus()` Unsigned Underflow (Insolvent-but-Unliquidatable Accounts)

A sole borrower will erase debt and leave stablecoin supply unbacked

Borrowers will underpay decay interest, reducing protocol/Vault yield

Redeemer will drain collateral from solvent borrowers

Borrowers will halt interest accrual and starve stakers/protocol

Replayable recovery requests allow attacker to permanently block account recovery

Marking a backup makes recovery impossible (recover list never queried)

Incorrect ticket price reference in JackpotBridgeManager causes user overpayment after price updates

Global Variable Manipulation During Active Draw Alters End Result

Current epoch resolved while trading continues enables trade-after-known-result

`BaseAuth.recoverSapientSignature` returns a constant instead of signer image hash, breaking sapient signer flows

Static signatures bound to caller revert under ERC-4337, causing DoS

Arbitrary token drain from Diamond via unverified Uniswap V3 mint callback

Settlement includes neighboring range, causing unintended mint/burn/collect outside requested ticks

Maker fees under-credited at non-visited nodes

JIT penalty wrongly applied on close leading to user fund loss

NFT minting via NFTManager DoS after 16 positions

Ownership transfer cannot be completed, causing permanent admin rotation DoS

Compounding maker cannot fully withdraw; funds become locked for sole holder

Incorrect Logic in onlyOperator Modifier Leading to Denial-of-Service for Authorized Operators Across Critical Functions

`SecondSwap_Marketplace` vesting listing order affects how much the vesting buyers can claim at a given step

Incorrect referral fee calculations

maxSellPercent can be buypassed by selling previously bought vestings at a later time

Calculation for `directionMask` is incorrect

Minting zero tokens when underlyingToken is not Ether in cashIn()

LP for v3 pool of underlying tokens with decimals != 18 would have incorrect NFT metadata

Anyone can manipulate user nonce (nonce_manager) in settlement contract

In Starknet already processed messages can be re-submitted and by anyone

_onTransferReceived() does not work as intended

Reentrancy Vulnerability Allows Bypass of Cooldown, Leading to Unfair Reward Extraction Through Flash Loan

Incorrectly assigned `decimal1` parameter upon decoding

The maximum number of generations is infinite

Forger Entities can forge more times than intended

Discrepancy between nfts minted, price of nft when a generation changes & position of `_incrementGeneration()` inside `_mintInternal()` & `_mintNewEntity()`

`AuraVault::claim` reward calculation does not deduct fees from reward amount, causing DoS or extra rewards lost

`PoolV3#repayCreditAccount()` use incorrect share converting function to calculate profit and loss

Lack of Slippage Control in `AuraVault::deposit` and `AuraVault::mint` Functions Can Lead to Unexpected Financial Losses for Users

Unclaimed Rewards Handling Issue in `AuraVault` Contract Functions (`AuraVault::deposit`, `AuraVault::mint`, `AuraVault::withdraw`, `AuraVault::redeem`)