Fracton Protocol

In the contract `FractonFFT` the role `IFractonTokenFactory(_factory).getDAOAddress()` has authority over the following functions: - `updateFee()` - `batchExcludeFromFee()` - `includeInFee()` - `excludeFromFee()` Any compromise to the `IFractonTokenFactory(_factory).getDAOAddress()` account may allow the hacker to take advantage of this authority and 1) Change the `vaultPercent` and `pfVaultPercent` variables, that decide the amount of tax deducted on transfer of tokens, by calling the `updateFee()` function. 2) Exempt multiple users at once from paying the tax by using the `batchExcludeFromFee()` function. 3) Include an exempted user to pay tax on transfer of tokens by using the `includeInFee()` function. 4) Exempt a user from the tax on transfer of tokens using the `excludeFromFee()` function. --- In the contract `FractonFFT` the role `IFractonTokenFactory(_factory).getSwapAddress()` has authority over the `swapmint()` function. Any compromise to the `IFractonTokenFactory(_factory).getSwapAddress()` account may allow the hacker to take advantage of this authority and mint as many tokens as they want and send them to any address.

1) The parameter `vaultPercent_` and `pfVaultPercent_` do not have an upper bound check. This means there is no upper bound on the tax that can be charged on a transfer of tokens. Moreover, the `transferFrom()` and `transfer()` function do not check if the tax deducted from the `value` is greater than the `value` itself or not. Since the tax does not have any upper limit, it is possible to have the `vaultFee` or `pfVaultFee` greater than the `value` being transferred. 2) In the function `multiTransfer()`, it is not checked if the length of the `receivers[]` array is equal to the length of the `amounts[]` array.