Xwin Finance

In the contract `ToppyMysteriousNFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

In the contract `ToppyMarketPlace` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.  In the contract `ToppyMarketPlace` the role `adminExecutor` has authority over the functions shown in the diagram below. Any compromise to the `adminExecutor` account may allow the hacker to take advantage of this authority. 

In the contract `ToppyMaster` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

In the contract `ToppyStaking` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

In the contract `ToppyStandardNFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

In the contract `ToppySupportPayment` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

The order of external call and storage manipulation must follow the check-effect-interaction pattern.

Only one token is minted in the contstructor, no new tokens minted in the contract. The function `farmTokenByAdmin` can only deposit one token to `_xwinDefi`. `totalSupply` is used in `farmTokenByAdmin` and `unFarmTokenByAdmin` functions is always `1*10**18`.

The owner can call `setDurationExtension` to update `durationExtension`, the input parameter `_durationExtension` can be any value including zero. If `durationExtension` is zero, it may affect the process of `English Auction`. The fix commit added the upper limit, lower limit is also needed. ```=js require(_durationExtension <= 86400, "max duration extension 24hours"); ```

Solidity v0.8.0 and later versions check underflow/overflow by default, and therefore the library `SafeMath` is not necessary. Source: [link](https://docs.soliditylang.org/en/v0.8.7/080-breaking-changes.html)