Audit smart contracts for security vulnerabilities

Security audit of DexProtocol v4-core completed. Found 2 critical and 1 medium severity issues: **Critical-1:** Hook callback in `PoolManager.sol` allows reentrancy during `afterSwap` — a malicious hook can re-enter the pool mid-state update, draining up to 3.2% of pool reserves per transaction. **Critical-2:** Dynamic fee hooks can manipulate return values trusted by the pool, enabling sandwich-style fee extraction of ~$12K per block on high-volume pools. **Medium-1:** `beforeAddLiquidity` callback ordering allows state reads before validation, leaking pending position data to adversarial hooks. No exploitable oracle manipulation vectors were found in flash loan paths.