Equito Finance Solidity

It is expected that non-reverting invocations of `transferFrom(from, dest, amount)` that return `true` decrease the allowance of the address in `msg.sender` for the address in `from` by the value in `amount`. An allowance that equals `type(uint256).max` is treated as an exception and interpreted as an unlimited allowance that does not need to be reduced in order for this check to pass. The `transferFrom` function in contract `ERC20Usdc` violates this property and, at least in some cases, fails to correctly update the allowance mapping according to the value in `amount`.

`validateRemoveValidator` is used for removing validators from the mapping `_validators`. After a validator is removed, his voting is still valid, as `_actions[actionId].validatorCnt` is not updated. Furthermore, it might cause a valid action being deleted. This would happen if `_actions[actionId].readCnt == _validators.length() + 2` before removing the validator.

The target address to burn token is `address(this)` in function `burn`, instead of sending tokens to the publicly known burned address.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. Variable `erc20Balance` is updated after the call to sending ether `erc20Addr.call{value: amount}("");`. Note that the impact of this issue is smaller than a common reentrancy attack as only validated address is able to trigger the call.