Improper pool initialization can lead to manipulation, unusability, or utilization rate overflow

Malicious actors can manipulate pool parameters during initialization through front-running attacks

Factory owner can drain user funds approved to the router contract via malicious pool creation

Users can gain tokens during round-trip swaps due to math library bugs in pool invariant

Partial redemption requests can be exploited to steal assets due to improper state management

Force withdrawal or emergency exit functions fail to update total liquidity correctly

Malicious actors exploit improper access controls to manipulate deposit/withdrawal token operations

Malicious users can permanently block withdrawals by exploiting deposit/withdrawal logic

Users cannot withdraw liquidity when pools are disabled, trapping funds during emergencies

First depositor can manipulate share-to-asset ratio through donation attacks

Total supply changes without proper LP token accounting updates cause pricing drift

LP token pricing vulnerable to flashloan or slot0 manipulation attacks

Attacker can drain funds by manipulating token balances during rebalancing operations

Flawed mathematical formulas or invariants in LP token calculations cause fund loss

Malicious users can keep others in liquidity cooldown indefinitely via small deposits

IV can be decreased without cost due to rounding errors in liquidity calculations

Burning liquidity positions fails to properly decrement token reserves

Flawed arithmetic or stale balance data in reward distribution leads to over/under-payment

Improper handling of reward timing causes inflation, trapping, or front-running of rewards

Token managers can exploit recoverERC20 or similar functions to steal reward tokens

Contract owner can change critical parameters like exchange rates and fees without restrictions

Ownership can be transferred to an arbitrary address without confirmation or safeguards

Direct token transfers can manipulate pool prices without triggering swap logic

Flawed share accounting during swaps, rolls, or fee collection leads to incorrect balances

Flawed liquidation price computation leads to improper liquidations or undercollateralized positions

Swap functions return unscaled token amounts, causing users to receive fewer tokens than expected

Missing validation for curve parameters enables creation of invalid liquidity curves

Impermanent loss protection can be exploited to drain reserve funds

Fee distribution logic fails to verify LP existence before allocation

Flash loans can manipulate stable interest rates and pool rates, amplifying LP losses