Rewards are lost due to integer division rounding and discrete reward updates

Removing token and adding it back on causes new stakers to receive more rewards than intended

FULL-restricted user can still stake by depositing to an unrestricted receiver (policy bypass in sNUSD)

Missing Validation for Native Token Amount in `withdrawToNativeChain`

Incorrect Access Control in `claimRefund`: Anyone Can Claim Refunds

Token Mismatch Vulnerability in `GatewayTransferNative` Functions

ETH Refund Failure in `GatewaySend::onRevert()` Causes Permanent Loss

USDT Incompatibility in GatewaySend: Assumes Standard ERC20 Behavior

The user can send tokens to any address by using two bridge transfers, even when transfers are restricted.

Single plot can be occupied by multiple renters

Availability of deposit invariant can be bypassed

Attacker can make 0 value deposit() calls to deny user from redeeming or withdrawing collateral

Users can lose access to funds due to minimum withdrawal limits.

The `BURNER` cannot burn tokens from accounts not KYC verified due to the check in `_beforeTokenTransfer`.

A locked fighter can be transferred; leads to game server unable to commit transactions, and unstoppable fighters

DoS in `MergingPool::claimRewards` function and potential DoS in `RankedBattle::claimNRN` function if called after a significant amount of rounds passed.

The quorumVotes can be bypassed

CultureIndex.sol#dropTopVotedPiece() - Malicious user can manipulate topVotedPiece to DoS the whole CultureIndex and AuctionHouse

Bidder can use donations to get VerbsToken from auction that already ended.

Lack of slippage control on LRTDepositPool.depositAsset

Update in strategy will cause wrong issuance of shares

ETHCrowdfundBase.sol#processContribution - Impossible to finalize crowdfund because of minContribution check

`PartyGovernanceNFT#rageQuit()` can lead to token loss for users when dealing with zero-balance ERC20 during a `rageQuit()`

Lenders can escape the blacklisting of their accounts because they can move their MarketTokens to different accounts and gain the WithdrawOnly Role on any account they want

Borrower has no way to update `maxTotalSupply` of `market` or close market.

Overflow can still happened when calculating `priceX8` inside `poolMatchesOracle` operation