Noti security record

The function `withdraw` uses `{value:}` structure and is designed to withdraw ether from the contract, but the `receive` function is missing from the `Noti` contract, making it impossible to receive native tokens.

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.

The linked comments indicate that the project utilizes a tax mechanism and the function `setExclusion` can exclude any provided address from tax. ```solidity=628 /** * @dev Updates the exclusion status of an address. * @param _account The address to update. * @param isExcluded_ Whether the address is excluded from tax. */ function setExclusion(address _account, bool isExcluded_) external onlyOwner { isExcluded[_account] = isExcluded_; } ``` However, the implementation only exclude the addresses stored in the `isExcluded` list from transfer. ```solidity=579 /** * @dev Overrides the transferFrom function to include tax logic. * @param from The address to transfer from. * @param to The address to transfer to. * @param amount The amount to be transferred. * @return A boolean value indicating whether the operation succeeded. */ function transferFrom(address from, address to, uint256 amount) public virtual override returns(bool) { address spender = _msgSender(); _spendAllowance(from, spender, amount); // Transfer the full amount if sender or recipient is excluded from tax _transfer(from, to, amount); return true; } function _transfer(address sender, address recipient, uint256 amount) internal override { require(contractState == ContractState.ON || isExcluded[sender] || isExcluded[recipient], "Incorrect state!"); super._transfer(sender, recipient, amount); } ```