xWIN Finance security record

In the contract `ToppyMysteriousNFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

In the contract `ToppyMarketPlace` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.  In the contract `ToppyMarketPlace` the role `adminExecutor` has authority over the functions shown in the diagram below. Any compromise to the `adminExecutor` account may allow the hacker to take advantage of this authority. 

In the contract `ToppyMaster` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

In the contract `ToppyStaking` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

In the contract `ToppyStandardNFT` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

In the contract `ToppySupportPayment` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. 

The order of external call and storage manipulation must follow the check-effect-interaction pattern.

Only one token is minted in the contstructor, no new tokens minted in the contract. The function `farmTokenByAdmin` can only deposit one token to `_xwinDefi`. `totalSupply` is used in `farmTokenByAdmin` and `unFarmTokenByAdmin` functions is always `1*10**18`.

The `systemReTrade()` function can be executed when there is a remaining buy or close-buy, but the `systemReTrade()` function does not take into account price fluctuations before reTrade. This can lead to a situation where the function is executed without considering the current market conditions, potentially resulting in unfavorable trades. ```solidity function systemReTrade() external onlyExecutor nonReentrant { TradeQueue memory tr = tradeQueue; require(tr.nextTrade && tr.nextTradeBlock <= block.number, "not allow to retrade yet"); if(tr.nextTrade){ _systemTrade(tr.tradeType); } } ```

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=125 uPerBlock = uPerBlock / (blocksPerDay * 365); ``` ```solidity=133 pendingMFee = pendingMFee + (totalblock * uPerBlock); ``` --- ```solidity=128 uint256 uPerBlockPlatform = supply / (10000 - platformFee) * 10000; ``` --- ```solidity=130 uPerBlockPlatform = uPerBlockPlatform / (blocksPerDay * 365); ``` ```solidity=134 pendingPFee = pendingPFee + (totalblock * uPerBlockPlatform); ``` --- ```solidity=225 uint256 redeemratio = amount * 1e18 / getFundTotalSupply(); ``` ```solidity=229 uint256 entitled = redeemratio * totalBase / 1e18; ``` --- ```solidity=262 uint256 redeemratio = redeemUnit * 1e18 / getFundTotalSupply(); ``` ```solidity=265 uint256 totalOutput = redeemratio * getBalance(baseCcy) / 1e18; ``` --- ```solidity=675 uint256 ratioNoReg = notRecognizedShare * 10000 / _shares; ``` ```solidity=680 uint256 partialProfit = ratioNoReg * (profitPerUnit / _unitprice) * swapOutput / 10000; ``` --- ```solidity=687 uint256 anotherProfit = ratioReg * profitPerUnit / _unitprice * swapOutput / 10000; ``` --- ```solidity=266 uint redeemratio = _shares * 1e18 / totalSupply(); ``` ```solidity=272 withdrawStable = redeemratio * stableBal / 1e18; ``` --- ```solidity=93 uint amountPerblock = stablecoinBal / swapDuration; ``` ```solidity=94 uint toSwapQty = amountPerblock * blockDiff; ``` --- ```solidity=186 uint redeemratio = _shares * 1e18 / totalSupply(); ``` ```solidity=187 uint totalRefund = stableBalB4 * redeemratio / 1e18; ``` --- ```solidity=202 uint redeemratio = _shares * 1e18 / totalSupply(); ``` ```solidity=203 uint totalRefund = stableBalB4 * redeemratio / 1e18; ``` --- ```solidity=314 uint redeemratio = (_shares * 1e18) / totalSupply(); ``` ```solidity=320 withdrawStable = (redeemratio * stableBal) / 1e18; ``` --- ```solidity=358 uint256 estimatedDailyReward = emmission * blocksPerDay * user.shares / totalShares; ``` ```solidity=359 estimatedDailyRate = estimatedDailyReward * 1e18 / user.amount; ``` --- ```solidity=369 uint256 estimatedReward = emmission * 365 * blocksPerDay * user.lockedShares / totalLockedShares; ``` ```solidity=370 apr = estimatedReward * 10000 / user.amount; ``` --- ```solidity=381 newShares = _amount * totalShares / totalXWINBalance(); ``` ```solidity=385 uint256 estimatedDailyReward = emmissionCompound * blocksPerDay * newShares / (totalShares + newShares); ``` --- ```solidity=392 uint256 estimatedReward = emmissionBonus * 365 * blocksPerDay * newLockedShares / (totalLockedShares + newLockedShares); ``` ```solidity=394 estimatedBonusApr = estimatedReward * 10000 / _amount; ``` --- ```solidity=178 uint256 cakeReward = multiplier * xwinPerBlock * pool.allocPoint / totalAllocPoint; ``` ```solidity=179 accCakePerShare = accCakePerShare + (cakeReward * 1e18 / lpSupply); ``` --- ```solidity=225 uint256 cakeReward = multiplier * xwinPerBlock * pool.allocPoint / totalAllocPoint; ``` ```solidity=229 pool.accCakePerShare = pool.accCakePerShare + (cakeReward * 1e18 / lpSupply); ``` --- ```solidity=394 uint xwinReward = xwinPerBlock * pool.allocPoint / totalAllocPoint; ``` ```solidity=395 uint accCakePerShare = xwinReward * 1e18 / lpBal; ``` --- ```solidity=403 uint256 userRatio = user.amount * 1e18 / pool.totalDeposit; ``` ```solidity=404 uint256 rewardPerBlockUser = xwinPerBlock * pool.allocPoint * userRatio / totalAllocPoint; ``` --- ```solidity=107 uint256 redeemratio = _amount * 1e18 / totalSupply(); ``` ```solidity=110 uint totalRefund = redeemratio * targetBalB4 / 1e18; ``` --- ```solidity=149 uint balanceStakingTokenInUSD = balanceStakingToken == 0 ? 0 : (balanceStakingToken * exchangeRateStaking / 1e18) * exRateTargetBase / getDecimals(address(targetToken)); ``` --- ```solidity=168 uint accruedCompInUSD = exRateLendingBase * accruedComp / getDecimals(address(stablecoinUSDAddr)); ``` ```solidity=169 uint percentage = accruedCompInUSD * 10000 / fundValueInUSD; ``` --- ```solidity=107 uint256 redeemratio = _amount * 1e18 / totalSupply(); ``` ```solidity=110 uint totalRefund = redeemratio * targetBalB4 / 1e18; ``` --- ```solidity=149 uint balanceStakingTokenInUSD = balanceStakingToken == 0 ? 0 : (balanceStakingToken * exchangeRateStaking / 1e18) * exRateTargetBase / getDecimals(address(targetToken)); ``` --- ```solidity=168 uint accruedCompInUSD = exRateLendingBase * accruedComp / getDecimals(address(stablecoinUSDAddr)); ``` ```solidity=169 uint percentage = accruedCompInUSD * 10000 / fund