The user can send tokens to any address by using two bridge transfers, even when transfers are restricted.

Single plot can be occupied by multiple renters

Users can lose access to funds due to minimum withdrawal limits.

The `BURNER` cannot burn tokens from accounts not KYC verified due to the check in `_beforeTokenTransfer`.

A locked fighter can be transferred; leads to game server unable to commit transactions, and unstoppable fighters

DoS in `MergingPool::claimRewards` function and potential DoS in `RankedBattle::claimNRN` function if called after a significant amount of rounds passed.

Lenders can escape the blacklisting of their accounts because they can move their MarketTokens to different accounts and gain the WithdrawOnly Role on any account they want

Borrower has no way to update `maxTotalSupply` of `market` or close market.

Overflow can still happened when calculating `priceX8` inside `poolMatchesOracle` operation

Missing Slippage protection