Hector Network (Redemption System) Audit

In the contract `RedemptionNFT` the role `PAUSER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `PAUSER_ROLE` account may allow the hacker to take advantage of this authority and pause/unpause the transfer of FNFTs.  In the contract `RedemptionNFT` the role `_moderator` has authority over the functions shown in the diagram below. Any compromise to the `_moderator` account may allow the hacker to take advantage of this authority and mint tokens to hacker address.  ----- In the contract `HectorRedemption` the role `_moderator` has authority over the functions shown in the diagram below. Any compromise to the `_moderator` account may allow the hacker to take advantage of this authority and withdraw all tokens.  ----- In the contract `HectorRedemptionTreasury` the role `_moderator` has authority over the functions shown in the diagram below. Any compromise to the `_moderator` account may allow the hacker to take advantage of this authority and withdraw all tokens.  ----- In the contract `LockAccessControl` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change `addressProvider`.  ----- In the contract `LockAddressRegistry` the role `MODERATOR_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `MODERATOR_ROLE` account may allow the hacker to take advantage of this authority and set moderators.  In the contract `LockAddressRegistry` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change important contract addresses.  ----- In the contract `TokenVault` the role `_moderator` has authority over the functions shown in the diagram below. Any compromise to the `_moderator` account may allow the hacker to take advantage of this authority and mint FNFTs and withdraw tokens.  In the contract `TokenVault` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and pause/unpause the contract.  ----- In the contract `HectorRegistration` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and set moderators.  In the contract `HectorRegistration` the role `MODERATOR_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `MODERATOR_ROLE` account may allow the hacker to take advantage of this authority and add registered wallets or blacklist addresses. 

The contracts in scope are part of a broader system that includes substantial off-chain components. These off-chain components play an essential role, such as calculating the amount of tokens users can redeem, and they are not in scope for this audit. The scope of the audit treats off-chain components and third-party entities as black boxes and assumes their functional correctness. However, in the real world, they can be compromised and this may lead to lost or stolen assets.

The `getBalancesFromWallet()` function calls `_getWalletBalance(_walletAddress)`, which adds `FNFTbalance` with various ERC20 token balances. The meaning of adding tokens of different types and values is unclear and could be confusing to users.

The linked contracts import and use OpenZeppelin's `Counters` contract. OpenZeppelin has deprecated the usage of the `Counters` contract: https://github.com/OpenZeppelin/openzeppelin-contracts/issues/4233

The `initialize()` function can be called multiple times. Prior initialization could be overwritten if called more than once.

The linked functions are equivalent to the compiler-generated getter functions for the respective variables.