Sweat EconomySweat Booster & Step Jars Security Review

#[near]impl NonFungibleTokenResolver for Contract {    fn nft_resolve_transfer(        &mut self,        previous_owner_id: AccountId,        receiver_id: AccountId,        token_id: TokenId,        approved_account_ids: Option<HashMap<AccountId, u64>>,    ) -> bool {        self.tokens            .nft_resolve_transfer(previous_owner_id, receiver_id, token_id, approved_account_ids)}}

#[near_bindgen]impl ScoreApi for Contract {    fn record_score(&mut self, batch: Vec<(AccountId, Vec<(Score, UTC)>)>) {        let mut event = vec![];         let now = block_timestamp_ms();         for (account, new_score) in batch {            self.migrate_account_jars_if_needed(&account);            ...            }  }

    #[tokio::test]async fn per_user_dos() -> anyhow::Result<()> {    let mut context = prepare_contract(        None,        [            RegisterProductCommand::Locked12Months12Percents,            RegisterProductCommand::Locked6Months6Percents,            RegisterProductCommand::Locked6Months6PercentsWithWithdrawFee,            RegisterProductCommand::Locked5Minutes60000Percents,        ],    )    .await?;

let alice = context.alice().await?;let manager = context.manager().await?;let products = context.sweat_jar().get_products().await?;assert_eq!(4, products.len()); context    .sweat_jar()    .create_jar(        &alice,        RegisterProductCommand::Locked12Months12Percents.id(),        1_000_000,        &context.ft_contract(),    )    .await?;let alice_principal = context.sweat_jar().get_total_principal(alice.to_near()).await?;let alice_interest = context.sweat_jar().get_total_interest(alice.to_near()).await?;assert_eq!(1_000_000, alice_principal.total.0);assert_eq!(0, alice_interest.amount.total.0);context.fast_forward_hours(1).await?;context    .sweat_jar()    .bulk_create_jars(        alice.to_near(),        RegisterProductCommand::Locked5Minutes60000Percents.id(),        10000,        500,    )    .with_user(&manager)    .await?;

    context.fast_forward_minutes(5).await?;              context                  .sweat_jar()                  .claim_total(true.into())                  .with_user(&alice)                  .await                  .expect_err("The length of a log message 16440 exceeds the limit 16384");              // CLAIMING AGAIN BUT ALL JARS ARE LOCKED              let claimed_details = context.sweat_jar().claim_total(Some(true)).with_user(&alice).await?;              let ClaimedAmountView::Detailed(claimed_details) = claimed_details else {                  panic!()              };              let claimed_amount = claimed_details.total.0;              assert_eq!(claimed_amount, 0);              // Cannot withdraw              context                  .sweat_jar()                  .withdraw(U32(1), None)                  .with_user(&alice)                  .expect_error("Another operation on this Jar is in progress")                  .await?;              Ok(())          }

for jar in &mut account_jars.jars {    let product = self        .products        .get(&jar.product_id)        .unwrap_or_else(|| env::panic_str(&format!("Product '{}' doesn't exist", jar.product_id)));     if !product.is_score_product() {        continue;    }     let (interest, remainder) = jar.get_interest(&score, &product, now);    ...}

fn burn(&mut self, token_id: TokenId) -> TokenMetadata {    self.owner_by_id.remove(&token_id).expect("Owner not found");     if let Some(approvals_by_id) = &mut self.approvals_by_id {        approvals_by_id.remove(&token_id);    }     self.token_metadata_by_id        .as_mut()        .and_then(|by_id| by_id.remove(&token_id))        .expect("Token metadata not found")}

    #[test]fn burn_token_inconsistent_state() {    let oracle = oracle();    let mut context = Context::new(&oracle);    let media = "bafkiufjkssmvjby7srbr44ivexsexqvdvjby7hhoobl3q3twim3bgxffrm".to_string();    let media_hash = Base64VecU8::from(b"w5SZrIcpoakfcRUl5EvCa4hy2ZzscFe4bnZDNhNcpYs=".to_vec());    let denomination = U128(2_000_000);    context.switch_account(oracle);    // MINTING 1st TOKEN    context.with_deposit_yocto(DEPOSIT_FOR_MINTING, |context| {        context            .contract()            .mint_balance_booster(alice(), denomination.clone(), media.clone(), media_hash.clone());    });    // MINTING 2nd TOKEN    context.with_deposit_yocto(DEPOSIT_FOR_MINTING, |context| {        context            .contract()            .mint_balance_booster(alice(), denomination.clone(), media.clone(), media_hash.clone());    });    let alice_tokens = context.contract().nft_tokens_for_owner(alice(), None, None);    assert_eq!(2, alice_tokens.len());    let token_to_burn = alice_tokens.first().unwrap();    context.contract().burn(alice(), token_to_burn.token_id.clone());    let burnt_token = context.contract().nft_token(token_to_burn.token_id.clone());    assert!(burnt_token.is_none());

        // NONE EVEN THOUGH WE HAVE 1 UNBURNED TOKEN LEFT        assert!(context            .contract()            .tokens            .tokens_per_owner            .as_ref()            .unwrap()            .get(&alice())            .is_none());        // MINTING ANOTHER ONE        context.with_deposit_yocto(DEPOSIT_FOR_MINTING, |context| {            context                .contract()                .mint_balance_booster(alice(), denomination, media, media_hash);        });        let alice_data = context        .contract()        .tokens        .tokens_per_owner        .as_ref()        .unwrap()        .get(&alice())        .unwrap();    // LEN IS 1 EVEN THOUGH WE HAVE 2 TOKENS    assert_eq!(alice_data.len(), 1);    // CONTAINS 1 AND 2 EVEN THOUGH THE LEN IS 1    assert!(alice_data.contains(&"1".to_string()));    assert!(alice_data.contains(&"2".to_string()));}

fn claim_jars_internal(    &mut self,    account_id: AccountId,    jar_ids: Vec<JarIdView>,    detailed: Option<bool>,) -> PromiseOrValue<ClaimedAmountView> {    let now = env::block_timestamp_ms();    let mut accumulator = ClaimedAmountView::new(detailed);     let unlocked_jars: Vec<Jar> = self        .account_jars(&account_id)        .iter()        .filter(|jar| !jar.is_pending_withdraw && jar_ids.contains(&U32(jar.id)))        .cloned()        .collect();     let mut event_data: Vec<ClaimEventItem> = vec![];     let account_score = self.account_score.get_mut(&account_id);     let score = account_score.map(AccountScore::claim_score).unwrap_or_default();     for jar in &unlocked_jars {                ...

/// On claim we need to clear active scores so they aren't claimed twice or more.pub fn claim_score(&mut self) -> Vec<Score> {    let today = self.timezone.today();     let result = if today == self.update_day() {        let score = self.scores[1];        self.scores[1] = 0;        vec![score]    } else {        let score = vec![self.scores[0], self.scores[1]];        self.scores[0] = 0;        self.scores[1] = 0;        score    };     self.updated = block_timestamp_ms().into();     result}