All tokens can be stolen from `VirtualAccount` due to missing access modifier

If RootBridgeAgent.lzReceiveNonBlocking reverts internally, the native token sent by relayer to RootBridgeAgent is left in RootBridgeAgent

Assets may be lost when calling unprotected `AutoPxGlp::compound` function

Giant pools can be drained due to weak vault authenticity check

Call to declareInsolvent() would revert when contract status reaches liquidation point after repayment of credit position 1

Lender can trade claimToken in a malicious way to steal the borrower's money via claimAndRepay() in SpigotedLine by using malicious zeroExTradeData

Borrower/Lender excessive ETH not refunded and permanently locked in protocol