01  Accounting Desync    →  most common Critical (37% of all payouts)
02  Access Control       →  most common High
03  Incomplete Path      →  missing modifier on a sibling function
04  Off-by-One           →  boundary operators, index errors
05  Oracle Price         →  TWAP manipulation, stale prices
06  ERC4626 Vaults       →  share inflation, rounding attacks
07  Reentrancy           →  cross-function, cross-contract, read-only
08  Flash Loan           →  price manipulation, economic attacks
09  Signature Replay     →  cross-chain replay, missing nonce/chainId
10  Proxy/Upgrade        →  uninitialized implementation, storage collision