Hashflow-Audit3

Function `lzReceive()` receives messages from LayerZero endpoint and proceeds without a duplication check on `quote.txid`, nor does the payload contains a nonce that can be checked. The necessity of this validation depends solely on the reliability of LayerZero.

The contract is serving as the underlying entity to interact with one or more third party protocols, such as LazyZero, WormHole. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as message replay or loss, increasing fees of third parties, etc. Furthermore, as indicated in the Hashflow documentation, there is a risk for an LP when contributing assets to a public pool run by a market maker whose pricing algorithm fails to be profitable or becomes insolvent. If market makers can price assets off-chain, there is also a risk that they submit a favorable quote to an insider. In other words, they could self-deal, leaving LPs unable to withdraw their assets. Hashflow indicates that they are addressing these risks by only working with market makers that have a proven track record in CeFi.