Digcrypto - Audit

In the contract `DigCryptoHouse`, the role `MINTER_ROLE` has authority over the following functions: - setMaxHouseSupply - safeMint - setHousePrice Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority.

A user is able to mint DGN NFT if the mapping `mapping(uint8 => boxSupply) private _maxBoxSupply` for certain box is not set using `setMaxBoxSupply`, as function `validateBoxSupply` does not check anything if `_maxBoxSupply[boxRarity].maxSupply ==0`.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. The ERC721 _safeMint() functions have an external call _checkOnERC721Received() to the recipient, which might cause potential reentrancy.

`msg.value` is used inside a for loop. The incoming payment may be processed multiple times unexpectedly. Currently, houses are at different prices, so this would not be a big issue. However, function `setHousePrice` is added to change the house price, making it possible to let multiple houses have the same price. In this case, the user is able to buy multiple houses by paying once.