The user can send tokens to any address by using two bridge transfers, even when transfers are restricted.

maybeResendFromStore may wrongly submit a checkpoint transaction twice

Approve operation is not overridden to call transferSanity, thus its allowed to approve blacklisted accounts, which breaks protocol invariant

Protocol fees won't be charged in some cases where dCDS user has opted-in for liquidation

Liquidation amounts are not correctly deducted from the totalCDS value available, when doing a dCDS withdraw

LiquidationType2 does not mark the deposit as liquidated, which enables borrower to withdraw it after liquidation

renewOptions deadline if-check is invalid and will never revert

withdrawing a deposit does not check if optionFees have expired

After closing synthetix position we don't update global data for liquidations

Sending excess msg.value to user which is being liquidated instead to the msg.sender/admin can lead to DoS

We are wrongly double-calculating the omni-chain cumulativeValue

For CDS withdraw the passed signature nonce is not verified, so anyone could use an outdated excessProfitCumulativeValue signature from admin2.

Attacker can use redeemUSDT to steal all funds from treasury, as we can specify the usda and usdt prices

Abond token transferFrom has a flaw which leads to an unwanted state

omniChainData will always be inacurate due to cross-chain message collisions

Cross-contract Reentrancy between Borrowing and CDS contracts will leave the omnichain in wrong state

usdaGainedFromLiquidation is not updated during liquidation, which leads to discrepancies when redeeming

Protocol fees from gains cannot be withdrawn from treasury

Synthetix is not deployed on Mode L2

No slippage protection when exchanging with synthethix

No way to retrieve sUSD margin and PNL profits from closed synthetix perpetual position

Setting wrong fill price for synthetix position when doing a liquidation type 2

We cannot make weth deposit before getting it from the treasury

Excess msg.value sent for OFT transfer will be stuck in the contract.

Withdrawing ionic during liquidation has a flaw

Calculating margin with ETH price instead of sETH price will lead to DoS of liquidation type 2

Lock-in period option for dCDS users is not enforced when trying to withdraw.

The volatility field for borrowing can be any arbitrary value and could be used to reduce option fees

Cross-chain wrsETH amount is wrapped before the treasury have received it, which could revert the whole transaction

dCDS depositors won't be able to withdraw their funds, if a lot of liquidations ocured since their deposit

If Lender gets blacklisted for USDC it will DoS borrower from repaying, which will lock up the collateral CTF tokens.

The Protocol is not strictly compliant with EIP721

Relist deposits fees to Uniswap pool for liquidation listings, which leads to accounting problems, stolen funds and inflation, as liquidation listings don't pay fees.

Locker is not setting checkpoints when minting/burning new supply of CT tokens, which can lead to loss of interest rate.

Malicious user can drain the Flayer pool, because reserve() does not delete old listing.

Fee exemption logic in UniswapImplementation will never work due to wrong bit-packing.

Lockbox listings can be self-liquidated for Free, allowing all floor deposits to be placed into Liquidation Dutch Listings.

`shareBalance` bloating eventually blocks curator rewards distribution

Signature replay in `createArt` allows to impersonate artist and steal royalties

Lack of data validation when users are claiming their art allows malicious user to bypass signature/merkle hash to provide unapproved `ref_`, `artId_` and `imageURI`

Attacker could update RedstoneOracle's price to an older one, to liquidate another position or benefit himself

Protocol's interestFees + Interest in a pool can be lost because of precision loss when using low-decimal assets like USDT/USDC.

`mintToken()`, `mintWithBudget()`, and `forge()` in the `TraitForgeNft` Contract Will Fail Due to a Wrong Modifier Used in `EntropyGenerator.initializeAlphaIndices()`

The maximum number of generations is infinite

Wrong minting logic based on total token count across generations

Forger Entities can forge more times than intended

NFTs mature too slowly under default settings.

`Golden God` Tokens can be minted twice per generation

Discrepancy between nfts minted, price of nft when a generation changes & position of `_incrementGeneration()` inside `_mintInternal()` & `_mintNewEntity()`

When malicious behavior occurs and DSS requests slashing against vault during 2 day period after `SLASHING_WINDOW` of 7 days is passed after staker initiates a withdrawal, token amount to be slashed is calculated to be higher than what it should be