SuperDCAStaking wipes bucket-accrued rewards on stake by resetting lastRewardIndex prematurely

Native token paired with dcatoken will DOS fee collection for listed positions as owner cannot collect fees

Attacker will redirect all token-bucket rewards to a owned pool by creating a another pool of token rewards and pinging the hook

inflated userTokenAmount due to bug in Protocol accounting

Attacker can max mint the entire supply while paying the mintfee for one token through mintBatch

Collection referrers percentage fee are also mistakenly sent to the mint referrer

_refundExcess() wont work making users lose excess ETH sent during minting in Edition

Lenders can escape the blacklisting of their accounts because they can move their MarketTokens to different accounts and gain the WithdrawOnly Role on any account they want

Borrower has no way to update `maxTotalSupply` of `market` or close market.

Borrower can drain all funds of a sanctioned lender

Function WildcatMarketController.setAnnualInterestBips allows for values outside the factory range

The peg stability module can be compromised by forcing lowerDepeg to revert.

LMPVaultRegistry removeVault forgot to vault address from _vaultsByType

`MagnetarV2#burst` double counts `msg.value` for `TOFT_WRAP` operation, making the transaction revert unless the user overpays

Single UniswapV3Swapper using a single fee makes it highly likely to be suboptimal

all deposit and withdraw function in Convex and Curve nativeLP Strategy, apply slippage on internal pricing; which call real-time on chain price from Curve directly and subject to MEV

Option Reciever can take out collateral in put options without adding collateral Due to Rounding Errors