Plexus Pool - Audit 2

In the contract `TokenSwap` the role `MINTER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily mint tokens to any account.  In the contract `TokenSwap` the role `SETTING_CONTRACT` has authority over the functions shown in the diagram below. Any compromise to the `SETTING_CONTRACT` account may allow the hacker to take advantage of this authority and arbitrarily set the allowed blockchains and commission prices.  In addition, the role `DEFAULT_ADMIN_ROLE` has the authority to assign `MINTER_ROLE` and `SETTING_CONTRACT` accounts. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily assign privileged accounts.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. - In function `swap()` and `_swap()`, input argument `externalRecipient` is not zero-checked before being used in the `SwapToken` event. ```solidity=1061 function swap( string memory externalRecipient, string memory toBlockchain, uint256 amount ) public payable virtual { require(msg.value >= commissionPrice[toBlockchain], "TokenSwap: low gas price."); payable(recipientCommission).transfer(msg.value); _swap(msg.sender, address(this), externalRecipient, toBlockchain, amount); } ```