Fitburn (Audit)

Tokens that are penalized by the user are left in the contract and cannot be withdrawn directly by the user. We did not find a `withdraw()` method that allows the owner to retrieve these penalized tokens.

The function `receiveReward()` allows the owner of the specified stake to receive the reward, If a user performs the following actions: - 1, Calls the function `receiveReward()` after a staking period, passing the parameter `withdrawDeposit` as false, then the variable `stake.cycles` will be equal to 1. - 2, Immediately calls the function `receiveReward()` again, passing the parameter `withdrawDeposit` as true, then at line 219 of the code, the variable `depositItem.amount` will be equal to `stakeAmount`, but the variable `_penalties[depositItem.token][depositItem.tokenId]` will be updated. This could potentially allow the owner of the project to withdraw assets belonging to other users.

If a user deposits ERC721 tokens for a period that is less than one, the `depositItem.amount` in line 180 may become 0 due to the penalty mechanism. However, the transfer of ERC721 tokens to the user is based on the token ID, so the user can avoid the penalty.

The `AbstractVesting` contract is designed to gradually release tokens stored in the contract over a certain period of time. The contract includes a `topUp()` method that allows users to transfer tokens to the contract. To support the transfer of ERC1155 tokens to the contract, it is necessary to implement the corresponding onReceived methods.

If the asset being deposited is 721 or 998, and the user's staked time is less than one cycle, the `stake.deposit[i].amount` is not set to 0, which is inconsistent with other situations where it is set to 0. Since `stake.activeDeposit` has already been set to false, this issue will not result in any loss of assets.

Based on the code logic, the user can withdraw both their deposited tokens and rewards by setting the `withdrawDeposit` parameter to true. Otherwise, if `withdrawDeposit` is set to false, only the rewards will be withdrawn, which is inconsistent with line 191 comment.

The `receiveReward()` function can be called by the user to receive their reward. The user can pass the `breakLastPeriod` parameter as either true or false. By setting `breakLastPeriod` to false, the check on line 222 of the code `!breakLastPeriod` will always evaluate to true.

The formula for calculating the reward is as follows: ```solidity=237 (finishTimestamp - startTimestamp) / period ``` Therefore, if a user deposits tokens for less than one PERIOD, the reward will not accumulate cumulatively. Additionally, if the user claims their reward without withdrawing their tokens, their reward may be partially reduced.

The function `setFactories()` can be called by an admin to modify the variables `_minters` and `_manipulators`. If the original `minter` and `manipulator` have been authorized with additional permissions, then when these variables are modified, the original permissions are not revoked.

The `removeFactory()` function is used to remove an address. However, it only sets the location corresponding to the address in the array to `address(0)`, without reducing the length of the array. This can cause wasted gas during subsequent searches. And when `grantFactoryMintPermission()` or `grantFactoryMetadataPermission()` is called to authorize the address, `address(0)` will also be authorized. Additionally, when an address is removed, it may be necessary to also revoke the corresponding permission.