ApxUSD Stablecoin

`ApyUSD` overrides `_decimalsOffset()` to return `0`. OpenZeppelin documents that this default makes the classic first-depositor inflation attack unprofitable: the `+1` virtual term in the share conversion captures ~50% of any donation, so the attacker’s expected gains are offset. A malicious actor can still grief users by depositing `1` wei, donating more than twice the victim’s deposit to the vault, and causing the victim’s `deposit()` to mint `0` shares (full loss for the victim at a net loss for the attacker). The issue affects the initial deposit phase when the vault is empty or nearly empty.

`MinterV0` records rate-limit usage in `requestMint()` but `executeMint()` does not re-check or update the rate limit. A minter can queue requests over time and then execute them in a short window, bypassing the intended issuance cap for the rate-limit period.