Sandwich attack to steal all ERC-20 tokens in the Fees contract

Borrower can use Refinance to cancel auctions so they can extend their loan indefinitely

During refinance() new Pool balance debt is subtracted twice

[H-04] Lender#buyLoan - Malicious user could take over a loan for free without having a pool because of wrong access control

Using forged/fake lending pools to steal any loan opening for auction

Stealing any loan opening for auction through others' lending pool

Token spending by Uniswap router doesn't get approved

A pool lender can fully drain another user's pool by abusing `buyLoan`

Lender contract can be drained by re-entrancy in `refinance` (collateral)

Save gas for collecting protocol fees and interests

Lack of pause pool function in Lender contract

Add an optional deadline parameter for dispute process

Malicious user can DOS vUSD withdrawals

Possible to buy tokens from other user funds who approved DODOApprove contract

No check if Arbitrum Sequencer is active for oracle

Lack of access control for minting USSD

Rebalance function can be manipulated by flashloan

No slippage protection in USSD UniV3SwapInput function

Chainlink oracle data feed can be outdated yet used anyway