PM borrow liabilities are omitted from backing, allowing phantom surplus settlement

Sponsored XRP `EscrowCreate` will fail with `tecUNFUNDED` for low-balance senders because the second post-amount reserve check is hard-coded to use no sponsor

Sponsee will trap sponsor's reserve liquidity by opening a sponsored `PaymentChannelCreate` whose post-amount balance falls below the source's own reserve floor

Sponsor of an MPT-backed `VaultCreate` or `LoanBrokerSet` will be silently overcharged one extra reserve slot — and prefunded sponsorship will fail outright — because `MPTokenHelpers::authorizeMPToken()` does not suppress tx sponsorship for pseudo-accounts

XChain destination-door bridge will stall on the first attestation for a new `createCount` because `applyCreateAccountAttestations()` runs the reserve gate against the door with empty sponsor while the next branch writes a sponsored claim object

LP funding a sponsored XRP `AMMDeposit` will see the deposit fail with `tecUNFUNDED_AMM` because `AMMDeposit::checkBalance()` reads `xrpLiquid()` for the sponsor instead of the LP, even though the XRP transfer is debited from the LP

Liquidation Eligibility Uses EMA but Seizure Uses Spot Price

Normal-Supply Withdraw Uses Uncapped supplyAmount for Liquidity Call and Can Drain Pooled Collateral

DexV2 fallback credit is written to `to_` but consumable only by msg.sender, stranding funds when `to_ != msg.sender`

[H-01] Lack of emergency withdraw function when no arbiter is set

Constructor of `Escrow` should make sure that `buyer`, `seller`, `arbiter` are different from each other.

Check price != 0 before interacting with IERC20

First depositor can break minting of shares

Rounding error in buyQuote might result in free tokens

not able to create claim

Supply cap of VariableSupplyERC20Token is not properly enforced

chainlink’s latestRoundData might return stale or incorrect price

transfer() depends on gas consts

Use a safe transfer helper library for ERC20 transfers

Accumulated ETH fees of InfinityExchange cannot be retrieved

ERC20 tokens with different decimals than 18 leads to loss of funds

The owner can mint all of the NFTs.