Nayms 2

As it presently is constructed, the contract `ERC20Wrapper` is vulnerable to the [allowance double-spend exploit](https://github.com/comitylabs/openzeppelin-contracts/blob/6bd6b76d1156e20e45d1016f355d154141c7e5b9/contracts/token/ERC20/IERC20.sol#L43), as with other ERC20 tokens.

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. The following functions do not have a proper validation of input parameters: 1. To enforce a maximum limit of `10000` on commission totals, add the line `require(s.tradingCommissionTotalBP <= LibConstants.BP_FACTOR, "commission total must be<=10000bp")`; 2. In `LibACL.updateRoleAssigner()` ensure that the `_assignerGroup` is actually present in the system; 3. `LibEntity._createSimplePolicy()`: the fact that `_stakeholders.roles.length == _stakeholders.entityIds.length` is not checked. The case where `number of roles > number of entityIds` would lead to an exception. However, the case `number of roles < number of entityIds` would let a simplePolicy be created with fewer assigned roles than the number of signing stakeholders. Also, as an extreme case, a policy can be created with 0 assigned roles and 0 stakeholders; 4. `LibEntity._createEntity()` does not check that the parameter `_entityAdmin` exists; 5. `LibEntity._validateSimplePolicyCreation()` does not check that the policy covers a minimum time (`maturationDate`); 6. `LibFeeRouter._updateTradingCommissionsBasisPoints()` does not check that the parameter `bp.tradingCommissionTotalBP` is within a certain minimum/maximum range (i.e. `bp.tradingCommissionTotalBP <= LibConstants.BP_FACTOR`); 7. `UserFacet.setEntity()` does not check that the parameter `_userId` is an existing user; 8. `GovernanceFacet.updateUpgradeExpiration()`: any `uint256` value from `0` to `max(uint256)` can be used; 9. `GovernanceFacet.cancelUpgrade()`: any upgrade can be canceled, even if it is expired or never existed. In that case, any typo in the parameter `id` would be uncaught; 10. `LibObject._enableObjectTokenization()`: an object can be tokenized with a `name == ""`; 11. `EntityFacet.enableEntityTokenization()`: the sysAdmin must make sure that the parameters `_name` and `_symbol` does not have any weird character that could create UX issues on the front-end; 12. `LibEntity._createSimplePolicy()`: the fact that the entity of the signing stakeholder is not the entity issuing the policy is not checked;