[H-01] Auction tokens will be lost forever when auction ends without bids

_checkpoint_total_supply() can checkpoint before a timestamp is complete

Claimable gauge distributions are locked when killGaugeTotally is called

Voters who withdraw ve tokens risk losing gained bribes rewards

Griefing an account from getting votes delegated to it

DOS can be caused by first liquidity provider of a stable pair

Bribe and fee token emissions can be gamed by users

distributeRewards function allows duplicate campaigns to be submitted by the updater

First liquidity provider of a stable pair can DOS the pool

Removing the item in array without preserving the array index making other functions unusable in CouncilMember.sol: burn() and StakingRewardsManager.sol: removeStakingRewardsContract()

Looping over unbounded `pendingStakes` array can lead to permanent DoS and frozen funds

Missing deadline check allow pending transactions to be maliciously executed

Owner can incorrectly pull funds from contests not yet expired

Lack of checking the existence of the Proxy contract

Insufficient validation leads to locking up prize tokens forever

Lender contract can be drained by re-entrancy in `setPool`

Sandwich attack to steal all ERC-20 tokens in the Fees contract

During refinance() new Pool balance debt is subtracted twice

Borrower can bypass maxLoanRatio's configuration of a pool via buyLoan()

[H-04] Lender#buyLoan - Malicious user could take over a loan for free without having a pool because of wrong access control

Using forged/fake lending pools to steal any loan opening for auction

Fee on transfer tokens will cause users to lose funds

Borrower can prevent his/her loan from being liquidated

A pool lender can fully drain another user's pool by abusing `buyLoan`

If a borrower or lender got blacklisted by asset contract, their collateral or loan funds can be permanently frozen with the pool

No expiration deadline leads to losing a lot of funds

Single-step process for critical ownership transfer is risky

Lender contract can be drained by re-entrancy in `seizeLoan`

Lender fails to giveLoan because of inconsistent length between `loadIds` and `poolIds`

Griefing a lender with dust loans

Multiple accesses of a mapping/array should use a local variable cache.

+= and -= are more expensive

Uncheck Arithmetic where overflow/underflow impossible

Unnecessary If condition in update() of Staking.sol

Fee-on-transfer tokens aren't supported

High - Funds can be lost if any participant is blacklisted