Sherlock

The following smart contract functions contain loops and could lead to an out-of-gas error if the number of supported ERC20 tokens and/or protocols by Sherlock is too large: 1. `Gov.protocolRemove` loops over the number of ERC20 tokens underlying SHERX. 2. `Payout._doSherX` loops over the number of ERC20 tokens underlying SHERX. 3. `SherX.calcUnderlyingInStoredUSD` loops over the number of ERC20 tokens underlying SHERX. 4. `SherX.harvestFor` loops over the number of ERC20 tokens stakers are allowed to stake in. 5. `SherX.setInitialWeight` loops over the number of ERC20 tokens stakers are allowed to stake in. 6. `SherX.redeem` loops over the number of ERC20 tokens stakers are allowed to stake in. 7. `LibPool.payOffDebtAll` loops over the number of protocols registered in the corresponding pool. 8. `LibSherX.calcUnderlying` loops over the number of ERC20 tokens underlying SHERX. 9. `LibSherX.accrueSherX` loops over the number of ERC20 tokens stakers are allowed to stake in. 10. `Manager.setProtocolPremium` loops over many protocols and tokens. In particular, because is a double loop, the inner call to `LibPool.payOffDebtAll(_token[i][j]);` may be invoked many times for the same token. Note that these are not the only functions with loops. There is a large number of functions with loops in the code base, where the loop boundary is given by the length of one of the input arrays to the corresponding function. Since those functions are external functions we assume that the caller will be notified by their wallet software in case the length of the input array is too large. However, all functions with loops should be in scope for this issue.

The `AaveV2.withdrawAll` and `AaveV2.withdraw` functions call the Aave lending pool `withdraw` function which returns the final amount withdrawn. Since this is an external contract and we have seen several past attacks where the vulnerable code has made implicit assumptions on calls to external contracts without explicitly checking them, we believe that this poses a risk in case the amount withdrawn from Aave would be much lower than the expected amount.

All dependency versions inside `package.json` are unlocked due to `^` before the version number. Moreover, the core dependency, namely the [`diamond-2` repo](https://github.com/mudgen/diamond-2) is specified without any version number, which means that the latest commit from the `master` branch will be used when calling `yarn install`. Such a commit might be insecure or unstable since it is not necessarily a release commit.