Optix

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user stakes 100 deflationary tokens (with a 10% transaction fee) in a vault, only 90 tokens actually arrived in the contract. However, the user can still withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. The vault takes the pool token balance (the `collateralReserves`) into account when calculating the users' reward. An attacker can repeat the process of deposit and withdraw to increase the token balance (`collateralReserves`) in a deflationary token pool and cause the contract to lower the reward amount. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f

The contract is serving as the underlying entity to interact with third party token and oracle protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

The return value of an external call is not stored in a local or state variable. ```solidity=78 factory.vaults(vaultId).isOptionValid(holder,oracle,optionSize); ``` --- ```solidity=151 factory.vaults(vaultId).collateralToken().approve(address(this), remain); ``` --- ```solidity=154 factory.vaults(vaultId).provideAndMint(address(this), remain, false, true); ``` --- ```solidity=181 collateralToken.approve(address(this),collateralOut); ```

The linked variables could be declared as `constant` since these state variables are never modified.