data/vulnerabilities.md

First Line is always the issue and second line is the issue description then space and the same repeats.

Non-compliance with EIP4626 standard - previewDeposit As per EIP4626, all the preview functions must not take into account any limitation of the system, like those returned by the max() methods. In the contract, the preview methods do take into account system limitations.

Additive burn (rounding vulnerability) Due to rounding in conversions to AToken, if the conversion rate is high enough, one can withdraw a small amount that will result in the system transferring underlying tokens but burning zero ATokens of the user's account

Additive mint (Stable debt token) Due to rounding in conversions to stable debt token, if the conversion rate is high enough, one can deposit a small amount that will result in the system transferring underlying tokens but minting debt tokens to the user's account

Non-compliance with EIP4626 standard - previewDeposit As per EIP4626, all the preview functions must not take into account any limitation of the system, like those returned by the max() methods. In the contract, the preview methods do take into account system limitations.

Non-compliance with EIP4626 standard - previewMint As per EIP4626, all the preview functions must not take into account any limitation of the system, like those returned by the max() methods. In the contract, the preview methods do take into account system limitations.

Non-compliance with EIP4626 standard - previewWithdraw As per EIP4626, all the preview functions must not take into account any limitation of the system, like those returned by the max() methods. In the contract, the preview methods do take into account system limitations

Non-compliance with EIP4626 standard - previewRedeem As per EIP4626, all the preview functions must not take into account any limitation of the system, like those returned by the max() methods. In the contract, the preview methods do take into account system limitations

Non-compliance with EIP4626 standard - non-reverting functions as per EIP4626, the functions totalAssets, maxDeposit, maxMint, maxWithdraw, and maxRedeem must not revert by any means. In the contract, however, these functions may revert due to over/underflows of arithmetical computations

Discount Factor Issue (Unfair finalization within a batch) If two users in the same finalization batch entered the queue at different share rates (e.g., before and after a slashing event), the finalization logic weights the amount incorrectly. This can lead to one user losing ETH at the expense of another user within the same batch, which violates the FIFO principle of fairness.

Potential for incorrect ETH transfer due to price calculation The claim function relies on the _calculateDiscountedBatch function, which was part of the original discount factor logic. The flaw in the finalize function's discount factor calculation directly impacts the amount of ETH that a user can claim. If the finalization was processed with a flawed discount factor, the user will claim an incorrect amount of ETH, either losing funds or gaining more than entitled