Draining a meta-transaction vault through a relayer credit-transfer with no signature check, plus the intended ECDSA malleability and cross-function reentrancy chain
Draining a lending pool through a proxy storage collision that aliases pendingAdmin onto the oracle price, reachable via an unpermissioned multicall self-call
Proving a stripped validator is secret-independent, re-implementing its integrity VM and XOR keystream, then taking the uncapped base credit path the 40000 bonus cap was there to hide
