Aida Circle - Audit 1

In the contract AidaNFT.sol the role `GOV_ROLE` has authority over the following functions: - withdraw() - pause() - unpause() The role `WITHDRAWN_VALUE_ROLE` has authority over the following function: - withdraw() Any compromise to the `GOV_ROLE` and `WITHDRAWN_VALUE_ROLE` accounts may allow a hacker to take advantage of this authority and withdraw ETH from this contract and pause/unpause mint() and withdraw() functions.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=69 _safeMint(msg.sender, id); ``` * This function call executes the following external call(s). * In `ERC721._checkOnERC721Received`, * `IERC721Receiver(to).onERC721Received(_msgSender(),from,tokenId,data)` ### State variables written and Event emitted after the call(s) ```solidity=70 _setTokenURI(id, metadataURI); totalWithdrawals += msg.value; emit tokenMint(id, metadataURI, msg.sender, msg.value); metadataURIExists[metadataURI] = true; ``` An attacker can perform a reentrancy attackto mint multiple NFT using the same "metadataURI".

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=84 holderAddress.transfer(amount); ``` - `AidaNFT.withdraw` uses `transfer()`.