HeHe security record

### Ownable In the contract `Ownable` the role `_owner` has authority over the functions listed below. - transferOwnership(): transfer ownership of the contract to a new account. - renounceOwnership(): leave the contract without owner. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and manage the ownership of the contract. ### LzApp In the contract `LzApp` the role `_owner` has authority over the functions listed below. - setConfig(): set the configuration of the LayerZero messaging library of the specified version. - setSendVersion(): set the `send()` LayerZero messaging library version to `_version`. - setReceiveVersion(): set the `lzReceive()` LayerZero messaging library version to `_version` - forceResumeReceive(): only when the UA needs to resume the message flow in blocking mode and clear the stored payload. - setTrustedRemote(): manage state variable `trustedRemoteLookup`. - setTrustedRemoteAddress(): manage state variable `trustedRemoteLookup`. - setPrecrime(): manage state variable `precrime`. - setMinDstGas(): manage state variable `minDstGasLookup`. - setPayloadSizeLimit(): manage state variable `payloadSizeLimitLookup`. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and manage the configuration of the contract. ### OFTCore In the contract `OFTCore` the role `_owner` has authority over the functions listed below. - setUseCustomAdapterParams(): manage state variable `useCustomAdapterParams` Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and manage the configuration of the contract.

In the function `setTrustedRemote()`, it is noted that `_path` should be `abi.encodePacked(address, address)`. However, the `bytes calldata _path` is missing a sanity check for ensuring it is correct(e.g. address size == 20 bytes on EVM chains), which may cause the contract can not work as intended. Similar issue happens in the other functions, which contain `bytes calldata` or `bytes memory` address input.

There should always be events emitted in sensitive functions that are controlled by centralization roles.

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=119 precrime = _precrime; ``` - `_precrime` is not zero-checked before being used. ```solidity=32 lzEndpoint = ILayerZeroEndpoint(_endpoint); ``` - `_endpoint` is not zero-checked before being used.