Editions's mintBatch() function does not pay enough fee

FeeManager._splitProtocolFee() uses wrong collection referrer fee recipient

TitlesGraph._setAcknowledged() does not acknowledge an edge

TitlesGraph's `checkSignature()` does not properly check replayability

mintBatch() function cannot mint batch with mint fee

Edition._refundExcess() never refunds any excess

ERC2981 royalties discrepancy with strategy

Edition does not support ERC1155 interfaceId

Protocol may become insolvent

TWAPOracle price can be manipulated by depositing / withdrawing from the underlying pool

TWAPOracle price are calculated on very small windows

Withdrawing rewards will convert sdt to cvgSDT at any rate

ChainlinkAdapterOracle can still give stale data

AuraSpell openPositionFarm does not join pool

Racing condition in between repaying and liquidating a debt when repay was not allowed

Borrower can front-run lender's acceptBid to lower/remove its collateral

Anyone can commit collateral for someone else

_repayLoan will fail if lender is blacklisted

Missing access control in setCollateralEscrowBeacon

Bid submission vulnerable to market parameters changes

lenderAcceptBid vulnearble to changes in market fees

CollateralManager.withdraw function lacks access control

Racing condition in between withdrawing a defaulted loan collateral and repaying the loan

Fee on transfer tokens not handled

Loans are liquidateable even when honest if bidDefaultDuration < paymentCycle

Unsafe use of AddressSet in LenderCommitmentForwarder allows unauthorized borrowers

Abuse decreaseTotalLp for DOS

SetLimit does not take into account burned OHM

Protocol assumes 18 decimals collateral

Keepers can clean off debts

TAU burnFrom lowers wrong currentMinted value

checkAfterExecution threshold constraints incorrect

Increase the number of valid signers past maxSigners

Move tree root to different tree without consent

Fail to set safe threshold to targetThreshold

_guardEntries not protecting against re-entry

Prevent deployment of HSG when safe has more than 5 modules

Usage of HSG for existing safe can brick safe

setTargetThreshold can set target below minThreshold

Pool withdraw vulnerable to flash loan

Incorrect reward tracking / calculation

cachedUserRewards is never cleaned

Adding reward token with future timestamp may break vault

removeInternalRewardToken does not clean storage value for users

Liquidate pays out full colateral for one token repaid

Fail to accrue interests on multiple token positions

Bank totalLend accounting wrong

Roll multiple times on a loan to lock it for a long time

Quadratic voting tally done wrong