VNST - audit

The `VNSTProtocol` contract uses the `approve` and `transferFrom` pattern within the following functions to transfer tokens from the contract to another address: - `emergencyWithdraw` - `withdrawUSDT` - `withdrawOperationPool` In these functions, the contract first calls `approve()` to approve itself, and then calls `transferFrom()` to transfer tokens from itself to another address. This pattern is generally less efficient and more error-prone than directly using the `transfer()` function.

The `redeem_fee` and `mint_fee` variables in the contract have no set limits, allowing fees to potentially reach 100%. If this occurs, users would receive no tokens from the contract, resulting in a complete loss of their investment.

The `VNSTProxy` logic contract does not protect the initializer. An attacker can front-run the `initialize` call and assume ownership of the logic contract. Once in control, the attacker can perform privileged operations, misleading users into believing that they are interacting with the legitimate owner of the upgradeable contract.