IguVerse - Audit 1

The checked signed messages in `IgupToken.sol`, `TokenDistributor.sol`, and `Iguverse.sol` do not contain the function name or a domain separator. Not having the function name allows the signature to be reused if there is the same number of inputs and having no domain separator allows the signature to be reused on other contracts or chains. In particular, if the `minter` address in `IgupToken.sol` is the same as the `signer` address in `TokenDistributor.sol`, then the same signature can be used to `collect()` on both contracts.

In `execTransaction()`, if `ptFromContract` is the zero address, then `fromContractAmounts` of BNB are transferred to `ptFromContractRecievers`. However, the BNB being transferred is from the `msg.value` which is sent by an account not the contract.

The function `isApprovedForAll` gives approval to `address(this)` for any `owner`. This may allow the contract to transfer or burn any tokens without the approval of the `owner`.

The error message for `mintTo()` only mentions the minter role, but the `owner` can also mint. Similarly, the error message for `transferTo()` only mentions the signer role, but the `owner` can also transfer.

In the file IguVerse.sol in the function `execTransaction()`: - If `ptFromAccount` is a nonzero BEP20 address, then `fromAccountAmounts` are transferred from `msg.sender` to `ptFromAccountReveivers`. However, it is never checked that the sum of the `fromAccountAmounts` is less than or equal to the balance of `msg.sender`. - If `ptFromContract` is a nonzero BEP20 address, then `fromContractAmounts` are transferred from `address(this)` to `ptFromContractReveivers`. However, it is never checked that the sum of the `fromContractAmounts` is less than or equal to the balance of `address(this)`.

Since the `vestingAmount` also contains the `activationAmount`, it should always be greater than or equal to the `activationAmount`. In the function `addVestingEntries()`, there is no require statement to check whether in the newly added vesting entry, `activationAmount` is less than equal to the `vestingAmount`.

The return value of the transfer()/transferFrom() call is not checked for `token` in `TokenDistributor.sol`.

After [EIP-1884](https://eips.ethereum.org/EIPS/eip-1884) was included in the Istanbul hard fork, it is not recommended to use `.transfer()` or `.send()` for transferring BNB as these functions have a hard-coded value for gas costs making them obsolete as they are forwarding a fixed amount of gas, specifically `2300`. This can cause issues in case the linked statements are meant to be able to transfer funds to other contracts instead of EOAs.