Tengoku Senso

The function `TGKNFTContract.mintNFT()` does not restrict which addresses can mint NFTs since this function is public and has no access control. Per the client's explanation, only the owner of `TGKNFTContract` should be able to call `mintNFT()`.

The system documentation found in the file `README.md` is insufficient and does not clearly describe how the system is expected to work. Still, the team provided a more complete explanation during the audit.</br> Also, the codebase does not contain a test suite. This has two main consequences: * it is not possible to check that the current version of the codebase behaves as expected. * any breaking change added in the context of a system update could remain undetected by the team.

The contract `TGKMainContract` is expected to receive ERC721 NFT tokens. These tokens can usually be received via different functions. Some of them, like `safeMint()` or `safeTransferFrom()` first check that the receiver address, if it is a contract, implements the function `IERC721Receiver.onERC721Received()` [described here](https://docs.openzeppelin.com/contracts/3.x/api/token/erc721#IERC721Receiver). If not, the NFT can remain stuck in the receiver contract. As the contract `TGKMainContract` does not implement the function `IERC721Receiver.onERC721Received()`, it will not be able to receive NFT tokens via any kind of safe transfer.

The contract `TGKNFTContract` does not compile due to incorrect inheritance declarations and gives two errors: ``` 1. Error (4327): Function needs to specify overridden contract "ERC721URIStorage". => needs to override ERC721URIStorage (since it is explicitly inherited) 2. Error (2353): Invalid contract specified in override list: "ERC721". => should not override ERC721 (since it is not explicitly inherited) ```</br> In detail, the contract `TGKNFTContract` does not inherit `ERC721`, and the function `supportsInterface()` is missing `ERC721URIStorage` from its override list.

In the `TGKMainContract.withdraw()` function, the `to` address is not validated against the zero address. As a result, an accidental loss of funds is possible.

While the Solidity compiler version is not given, the pragma for the contracts is written as `^0.8.9`, allowing the contracts to be compiled using versions below `v0.8.16`, which all have known compiler bugs. A list of known bugs in each specific version can be found [here](https://github.com/ethereum/solidity/blob/develop/docs/bugs_by_version.json).

The protocol owner has a privileged role and can execute specific functions. Therefore, users are exposed to the risk of being attacked if the privileged roles are malicious or compromised. The contract `TGKMainContract` has the following owner privileges: 1. The owner can withdraw any amount owned by the contract to any arbitrary address via the function `withdraw()`. 2. The owner can transfer any amount of any ERC20 token owned by the contract to any arbitrary address via the function `transferERC20()`. 3. The owner can transfer any ERC721 token owned by the contract to any arbitrary address via the function `transferNFT()`. Note that the owner of the contract is the address who deployed the contract and it cannot be updated.

The function `address.transfer()` assumes a fixed amount of gas to execute the call. The use of that function protects against reentrancy attacks. The default amount of gas, however, may change in the future. In the worst case, it could lead to failed transfers.