Maverick Protocol

In library Checkpoint, the function `initialize()` is used to initialize `buffer.maxSize` and to push the first Checkpoint instance to `buffer.list`. Currently this function can be called after the first valid call, which would still push new instances but bypass the updating logics in `append()`.

In contract Pool, the function `initialize()` is possible to be called multiple times, if the input `_quote` is zero address.

The function(s) which are never called internally within the contract could have external visibility for gas optimization. e.g. Checkpoint.sol: `twap()`

Performing integer division before multiplication truncates the low bits, which could potentially lead to the precision loss. Checkpoint.sol: `twap()` ```solidity uint256 previousU = (start.cumulative - previous.cumulative) / (start.timestamp - previous.timestamp); ``` ```solidity cumulativeDiff += (start.timestamp - startTimestamp) * previousU; ```

Addresses should be checked before assignment or external call to make sure they are not zero addresses.

In function `append()`, it seems possible that when `append()` is called, and when the function wants to immediately append a new buffer, the `buffer.end - 2` operation would lead to error. E.g. when `buffer.end` is `1`. ```solidity if (previous.timestamp == timestamp) { current = buffer.list[buffer.end - 1]; previous = buffer.list[buffer.end - 2]; ... ``` Also, the `diff` would be `0` when the condition of `previous.timestamp == timestamp` fulfills.

`boundries` <> `boundaries`

Checkpoint.sol: The `uint16 array` field in struct `Buffer` is never used. ZeroExRouter.sol: The `bytes calldata auxiliaryData` parameter in functions `sellTokenForToken()`, `sellEthForToken()` and `sellTokenForEth()` is never userd.