BetFin security record

In the contract `LiveRoulette`, the role `_admin` has authority to call the following functions: * setLimit() * createTable() * setMaxBets() Any compromise to the `_admin` account may allow the hacker to take advantage of this authority and modify the minimum and maximum bets, odds for different points and combinations in the game, freely open new multiplayer tables, and Set the maximum bet limit per place bet (_bitmaps.length). --- In the contract `LiveRoulette`, the role `core` has authority to call the following functions: * placeBet() Any compromise to the `core` account may allow the hacker to take advantage of this authority and place bets without transferring any tokens. --- In the contract `LiveRoulette`, the role `operator` has authority to call the following functions: * fulfillRandomness() It's noted that the contract is dependent on Gelato's VRF service, and the `operator` address is usually an official service node address provided by Gelato. Any compromise to the `operator` account may allow the hacker to take advantage of this authority and arbitrarily control the outcome of each round of the game.

In the previous code design, `allowedToWin` was used to limit the maximum possible win bet amount for all players during a single round of the game. However, in the current design, `allowedToWin` is used to limit the possible win bet amount for a single bet (a single `placeBet()` call). We would like to confirm with the development team what object `allowedToWin` is intended to limit. Additionally, due to changes in the `getPossibleWin` function, the reserve funds for the game bets will be much larger than originally designed. Therefore, the reserve fund for a single bet will more easily reach the 5% limit, and since `allowedToWin` only limits the single bet, it will more easily consume funds from the staking contract. This introduces a potential economic risk. Moreover, the current code still retains the previous `allowedToWin` check logic: ```solidity uint256 allowedToWin = (liro.token().balanceOf(liro.getStaking()) + roundReserved[_round]) * 5 / 100; // check if the possible win is allowed require(allowedToWin >= possibleWin, "MP03"); ``` This will cause `allowedToWin` to exceed 5%, leading to a mismatch with the `reserveFunds` function in the staking contract. While the code may pass the check in `MultiPlayerTable.sol`'s `placeBet()`, it may not pass the check in `staking.reserveFunds`.