Mayors security record

The following functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility.

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the internally charged transaction fee.

In the contract `Marketplace`, the `buyLootboxMP()` function uses the state variable `season.merkleRoot` which stands for an off-chain Merkle tree to verify whether a given user has the privilege to buy the NFT. Meanwhile, there is also in parallel a whitelist to determine such privilege in `buyLootbox()` function. What's more, in the function `buyLootboxMP()`, the parameter `proofs` is passed in by the message sender to verify whether it is in the Merkle tree. So the actual value is uncertain and malicious users can perform a second preimage attack. We would like to confirm with the client if the current implementation aligns with the original project design.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

It is now well understood that the difficulty or timestamp is not a source of randomness. They can be manipulated if the attacker is also a miner. For EVM compatible blockchains such as Binance smart chain and Polygon, the `block.difficulty` and `block.gaslimit` can be the same value across multiple blocks, making the situation even worse.

State variables that never change should be declared as `constant` to save gas. File: contracts/common/erc721/ERC721Storage.sol (Line 12, Contract `ERC721Storage`) ```solidity string internal _symbol; ``` - `_symbol` should be declared `constant`. --- File: contracts/common/erc721/ERC721Storage.sol (Line 15, Contract `ERC721Storage`) ```solidity string internal _baseURI; ``` - `_baseURI` should be declared `constant`. --- File: contracts/common/erc721/ERC721Storage.sol (Line 18, Contract `ERC721Storage`) ```solidity uint256 internal _tokenIdCounter; ``` - `_tokenIdCounter` should be declared `constant`. --- File: contracts/common/erc721/ERC721Storage.sol (Line 9, Contract `ERC721Storage`) ```solidity string internal _name; ``` - `_name` should be declared `constant`. --- File: contracts/common/ownership/OwnableStorage.sol (Line 6, Contract `OwnableStorage`) ```solidity address internal _owner; ``` - `_owner` should be declared `constant`.