Manual admin-count tracking can desynchronize from the real role set.

Scatter reads bypass the intended IO throttling path.

Week accounting can silently wrap after 255 weeks.

Embedded validator identifiers are trusted more than the authenticated sender.

The settlement leg can fail while accounting still advances.

Duplicate node IDs in ConfirmGroup can force redundant sends.

A fixed RNG seed makes peer selection predictable across runs.

Peers can trigger expensive verification and remain eligible for reselection.

A zero-stake validator set can be constructed from empty input.

Trailing optional fee fields are decoded by position rather than presence flags.

A zero execution delay can trigger a panic in the threshold comparison.

Votes for arbitrary future rounds can accumulate without a hard upper bound.

The txpool can admit insolvent transactions.

Wrong-version messages still incur expensive nested decoding work.

Documentation and configuration disagree on TFM support.

Traversal callbacks copy key and value buffers without finalizing FFI allocations.

The nonce path assumes backend result ordering without requiring it.

Unknown sequence numbers can still pace the preload timer.

The function copies descriptor content before validating the sequence number.

A globally hardcoded Blake3 type makes future hash migration brittle.