The auction can be started by anyone calling `settle` before `start_auction` is called by the owner

`cancelVouch` doesn't update the voucher index of the last vouch of a borrower properly

`refundDeposit` function can be DoS by an unbounded loop in `getLockedFunds`

Funders can deny rewards to last claimants by calling `refundDeposit` between tiers claims

Unsafe usage of `ERC20.transfer` and `ERC20.transferFrom`

First depositor can break minting of shares

ETH will get stuck if all NFTs do not get sold.

Unsafe downcasting operation truncate user's input

During oracle outages or feeder outages/disagreement, the `ParaSpaceFallbackOracle` is not used

Anyone in the order queue wanting to withdraw or deposit can grief the auction by making `withdrawAuction` or `depositAuction` always revert

Underlying assets stealing in `AutoPxGmx` and `AutoPxGlp` via share price manipulation

`UserManager.updateFrozenInfo` cannot be called from `UToken`

frxETHMinter: Non-conforming ERC20 tokens not recoverable

Supply cap of VariableSupplyERC20Token is not properly enforced