Labrado - Audit

The function `burn()` is used to burn the NFT of the given `tokenId`. However, the function `burn()` lacks access control and there is also no access check in the invoked function `_burn()` in OpenZeppelin's contract `ERC721`. ```solidity //OpenZeppelin's contract ERC721.sol function _burn(uint256 tokenId) internal virtual { address owner = ERC721.ownerOf(tokenId); _beforeTokenTransfer(owner, address(0), tokenId); // Update ownership in case tokenId was transferred by `_beforeTokenTransfer` hook owner = ERC721.ownerOf(tokenId); // Clear approvals delete _tokenApprovals[tokenId]; unchecked { // Cannot overflow, as that would require more tokens to be burned/transferred // out than the owner initially received through minting and transferring in. _balances[owner] -= 1; } delete _owners[tokenId]; emit Transfer(owner, address(0), tokenId); _afterTokenTransfer(owner, address(0), tokenId); } ``` As a result, anyone can call the function `burn()` to burn others' NFT. Reference: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/8d908fe2c20503b05f888dd9f702e3fa6fa65840/contracts/token/ERC721/ERC721.sol#L321

The call to `burn()` function will fail if the value of `totalSupply` is 0.

According to the codes in the project, the fee used in the contract is calculated by the variable `feeSwap`. However, in the function `computeProfitMaximizingTrade`, 0.3% is used directly instead of calculated by the variable `feeSwap`.

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.