Unioverse security record

The smart contract contains a modifier `onlyAllowlistedSourceChain` that is intended to restrict access to certain functions based on the originating blockchain and the sender's address. The modifier checks if the `_sourceChainSelector` is part of the `allowlistedChains` and if the `_sender` is in the `allowlistedSenders`. However, the logic does not correctly enforce the intended security constraint. It allows a call to pass as long as the chain and sender are independently allowlisted, without verifying that the sender is allowlisted specifically for the chain from which the call originates. For example, there are two chains named `ChainA` and `ChainB`. `AddressA` and `AddressB` exist in both chains. `ChainA.AddressA` and `ChainB.AddressB` are valid and have been added to the allowed list. According to the current implementation, if `ChainA.AddressB` or `ChainB.AddressA` makes a call, the check will incorrectly pass, allowing potentially unauthorized actions. ```solidity modifier onlyAllowlistedSourceChain( uint64 _sourceChainSelector, address _sender ) { if (!allowlistedChains[_sourceChainSelector]) revert SourceChainNotAllowlisted(_sourceChainSelector); if (!allowlistedSenders[_sender]) revert SenderNotAllowlisted(_sender); _; } ```

It is important to emit events for sensitive actions, particularly those that can be executed by centralized roles or administrators. This ensures transparency and enables tracking of critical changes, which is essential for security and trust in the system. Missing event logs can indeed result in a lack of visibility and potential information loss.