book_offers still marks issuer-owned MPT offers as funded after the issuance is globally locked

Clearing `lsfMPTCanConfidentialAmount` can leave encrypted residue that later invariant-bricks ordinary MPT transfers

Sponsored PaymentChannelCreate can use sponsor reserve support to satisfy the owner's own XRP reserve gate

XChainAddAccountCreateAttestation ignores reserve sponsorship for door-owned create-account claim objects

SponsorshipTransfer mutates ltVAULT sponsor state without vault privilege and invariant-fails reassign/end

Sponsored AMMDeposit can leave the depositor below reserve by using sponsor XRP liquidity on the reserve gate

EMA/SPOT price inconsistency in liquidation will cause systematic bad debt for the protocol and depositors

Deposit limit check double-subtracts `cash_reserve`, allowing deposits beyond `max_deposit_amount`