The design defect of the ActivePool rehypothecation mechanism, ReaperVaultV2 administrators have too much authority and have the conditions and motives to do evil, so make users lack trust in the ETHOS system (crisis of trust)

Lines of code Vulnerability details Impact In the design logic of the current system, ActivePool holds all the collaterals of active troves and deposits part of them in ReaperVaultV2 for re-mortgaging. If the deposit and withdraw functions of ReaperVaultV2 revert, Core functions such as borrowing...

ReaperVaultV2 withdrawals can be frozen if Granary market has liquidity shortage

Lines of code Vulnerability details Summary ReaperStrategyGranarySupplyOnly do not control for liquidity squeeze that is typical for lending markets and can routinely happen in Granary markets. I.e. some funds can be temporary locked just because they are lent out. This is locked funds situation...

Users would lose some shares during withdrawal in ReaperVaultV2._withdraw().

Lines of code Vulnerability details Impact ReaperVaultV2.withdraw burns 100% of shares even if the vault balance is less than the required underlying amount. As a result, users would lose some shares during withdrawal. Proof of Concept Users can receive underlying tokens by burning their shares...