Zoro Protocol security record

The following is a non-exhaustive list of existing or known issues in the Compound V2 codebase: 1. Empty market vulnerability: An empty market (i.e., cToken with a total supply of 0) is vulnerable to exchange rate manipulation that may lead to loss of funds in other markets managed by the same Comptroller. See [Compound's analysis](https://www.comp.xyz/t/hundred-finance-exploit-and-compound-v2/4266) on the Hundred Finance Incident for more details. This vulnerability can be triggered not only when a market is empty but also when an adversary controls the entire token supply of a market by, e.g., liquidating other users' positions. 1. Similar to the empty market vulnerability, if the underlying token of a market is compromised, the adversary might be able to drain the funds in other markets by inflating the underlying token balance in the cToken contract (and therefore the return value of `getCash()` and the exchange rate) with a low cost. 1. Some ERC-20 tokens are incompatible with the Compound V2 codebase and might cause issues when used as an underlying token. For example, tokens with transfer hooks (e.g., ERC-777), double-entry tokens (e.g., TUSD in the past), and tokens allowing balance changes without a transfer (e.g., rebasing tokens). 1. The `repayBorrowBehalf()` function in the `CEther` and `CErc20` contract allows a user to repay the entire borrow balance of another by specifying the `repayAmount` as `type(uint).max`. This could open an attack vector where the borrower front-runs the repayment transaction and increases the borrow balance, causing the repayer to spend more than expected. 1. In `CToken.mintFresh()`, the call to `comptroller.mintVerify()` is commented out, and the `comptroller.repayBorrowVerify()` function is never used in the codebase. Therefore, modifications to the `mintVerify()` or `repayBorrowVerify()` functions will not take any effect. 1. `Comptroller._supportMarket()` calls `isCToken()` on the provided `cToken` parameter but does not validate the return value as `true`. `Comptroller._setPriceOracle()` does not call `isPriceOracle()` on `newOracle` to check that the provided address implements a `PriceOracle`. 1. The `repayBorrow()`, `repayBorrowBehalf()`, `liquidateBorrow()`, and `mint()` functions in the `CEther` contract do not return a boolean, while the same functions in the `CErc20` contract do. Third-party contracts integrating with the `CEther` contract should be aware of such discrepancies.