NEST Protocol security record

NEST Protocol is a distributed price oracle network on the Ethereum Mainnet. The NEST Oracle Smart Contract 4.0 is a Solidity smart contract implementation of NEST Protocol which provides a unique on-chain Price Oracle through a decentralized mechanism. Different from other oracle approaches, NEST uses a unique “quotation mining” mechanism to ensure that off-chain price facts are generated on the chain synchronously, and NEST-Price price data is directly generated on the chain, which is designed to solve the industry problem of lack of price facts on the blockchain.(Reference : [Nest Protocol White Paper](https://www.nestprotocol.org/doc/ennestwhitepaper.pdf)) Because the share of the sheet has no relation with the scale, and the price sheet with inappropriate prices will be harvested, the miner may choose to open price sheets with very little scale. The miner needs to double the scale to arbitrage in the previous price sheet, which increases the risk of being arbitraged by other participants. There are no mechanisms to encourage more price sheets to be posted or taken, and the volume is not large enough to truly reflect the price of the pair. The following points are worth noting : 1. Each channel supports multiple token pairs, but only the first pair(channel.pairs[0]) can earn the reward. 2. Each channel will reward for the posted price in pairs[0], and the `opener` of channel could call function `NestBatchMining.increase())` to provide reward tokens, but the `opener` also can call function `NestBatchMining.decrease()` to withdraw reward tokens without limitation, which means role `Miner` or `Verifier` will not be able to get reward if the `opener` don't provide reward token or withdraw all of the reward tokens. 3. The amount of the award is related to `rewardPerBlock` in each channel. If the `opener` increases the `rewardPerBlock` without providing more reward tokens, then the `Miner` or `Verifier` will not get the reward they deserve.

In the following calculation, the transaction will revert when the subtracted number is less than the subtracted number : ```solidity=440 sheet.remainScales = uint32(uint(sheet.remainScales) - takeNum); ``` ```solidity=987 return value - tokenValue; ```

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to different compiler versions. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.