NFE security record

The contract `NonFungibleEstate` may assign its own address as the `protections` address. The contract however lacks certain implementations of the `Protections1 interface and functions `setLpPair()`, and `removeSniper()` each shadowing the `Protections` function and would result in an infinite loop.

The functions which are never called internally within the contract should have external visibility for gas optimization. ```solidity=289 function transfer(address recipient, uint256 amount) public override returns (bool) { ``` --- ```solidity=370 function getCirculatingSupply() public view returns (uint256) { ``` --- ```solidity=561 function enableTrading() public onlyOwner { ```

```solidity=322 function setNewRouter(address newRouter) external onlyOwner { require(!_hasLiqBeenAdded, "Cannot change after development."); IRouter02 _newRouter = IRouter02(newRouter); address get_pair = IFactoryV2(_newRouter.factory()).getPair(address(this), _newRouter.WETH()); if (get_pair == address(0)) { lpPair = IFactoryV2(_newRouter.factory()).createPair(address(this), _newRouter.WETH()); } else { lpPair = get_pair; } dexRouter = _newRouter; _approve(address(this), address(dexRouter), type(uint256).max); } ``` When the dex router is changed to a new one, the new router is approved for a maximum allowance from the contract. But the allowance for the old dex router is still greater than zero.

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=265 operator = newOperator; ``` - `newOperator` is not zero-checked before being used.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=148 IRouter02 public dexRouter; ``` - The contract `NonFungibleEstate` interacts with third party contract with `IRouter02` interface via `dexRouter`. --- ```solidity=171 Protections protections; ``` - The contract `NonFungibleEstate` interacts with third party contract with `Protections` interface via `protections`.

Inside the constructor, there are multiple checks for chain deployment. Since this is unnecessary in production, this could be removed to avoid spending useless gas.

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=577 payable(_owner).transfer(address(this).balance); ``` - `NonFungibleEstate.sweepContingency` uses `transfer()`.