Regarding F217 in the audit report.

[00xJi]

The underlying token can be used to repay debts. The crux of the matter is that unfinished deposits and completed withdrawals should not be counted as part of total assets.
Even if the underlying token is not included in token0/token1, the code implementation is still incorrect.
Neither of these reports addresses the key issue, and both should therefore be deemed invalid!