Two address tokens can be withdrawn by the admin even if they are vested

safeTransferFrom is recommended instead of transfer (1)

amount requires to be updated to contract balance increase (1)

Protocol doesn't handle fee on transfer tokens

ERC777 tokens can bypass `depositCap` guard

`call()` should be used instead of `transfer()` on an `address payable`

StakedCitadel doesn't use correct balance for internal accounting

StakedCitadel: wrong setupVesting function name

Splitter: Anyone can call incrementWindow to steal the tokens in the contract

ERC20 tokens with no return value will fail to transfer

createProject can be frontrun

WithdrawFacet's withdraw calls native payable.transfer, which can be unusable for DiamondStorage owner contract

cBridge integration fails to send native tokens

Anyone can get swaps for free given certain conditions in `swap`.

`msg.value` is Sent Multipletimes When Performing a Swap

call to non-existing contracts returns success

Escrowed NFT can be stolen by anyone if no active buyPrice or auction exists for it

StakedCitadel doesn't use correct balance for internal accounting

StakedCitadel: wrong setupVesting function name

deposit in ConvexStakingWrapper will most certainly revert

execute in VoteProxy should be payable

[ConcurRewardPool] Possible reentrancy when claiming rewards

Double transfer in the `transferAndCall` function of `ERC677`

Possible incentive theft through the arbitraryCall() function