FreeCity

In the contract `FreeCityGame_v2.sol`, the function `setBlindBoxBaseUrl()` can be called by anyone as it has no access restriction. This enables anyone to call this and change the URI (Uniform Resource Identifier) of a blind box.

Boolean constants can be used directly and do not need to be compared to `true` or `false`.

Accessing storage variables in a loop can be costly in terms of gas consumption. ```solidity=261 blindBoxCurrentData = blindBoxCurrentData + 1; ```

There should always be events emitted in sensitive functions that are controlled by centralization roles.

There is no limit on the `protocolFee`, which can therefore be set to an amount that could potentially disrupt contract functionality.

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

In the contract `FreeCityGame_v2.sol`, the variable `blindBoxBaseUri` is misspelled as `blindBoxBaseUrl`.

The following state variables are initialized, but never used in the codebase. * `proxyRegistryAddress` * `_tokenURIs` * `preSales` * `__gap`

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. These functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Additionally, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=407 payable(protocolFeeRecipient).transfer(calculatedProtocolFee); ``` - `ExchangeCore.executeFundsTransfer` uses `transfer()`.