LinoSwap

In the contract `LinoswapV1Factory` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the exploiter to take advantage of this authority and do the following: - Change the protocol fee share and recipient and also withdraw any protocol fees. - Allow rarity value curves, rarity functions, and basic curves which can be used to create pools that the exploiter can then exploit. - Allow a signer, which can then sign malicious `LiquidityNFT`'s allowing them to set the rarity rank percentage as high or low as they want to gain additional tokens when swapping, adding liquidity, or removing liquidity.  --- In addition, in the contract `LinoswapV1Pool` the Factory `owner` has control over the following functions: - withdrawProtocolFee() - withdrawNFT() Any compromise to the factory `owner` account may allow the exploiter to take advantage of this authority and withdraw protocol fees or NFT's not in the pool held by the contract.

The name `_isNFTsNotInPool()` implies that if all `NFT`'s are not in the pool that this will return true. However it returns false if this is the case.

The contract is serving as the underlying entity to interact with one or more third party `NFT` protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc.