Cosine: ERC404 is not yet a mature standard, and its mechanism may bring new security risks.

Yu Xian, the founder of SlowMist, posted on the Assume this is a coin with FT on the front and NFT on the back. When you trade FT, the rarity of the other side of the coin (NFT) is given out without any difference by _owned[from].pop(). Or, if the number of FT is slightly less than an integer, one NFT will also be burned. For example, your FT is 3, corresponding to 3 NFTs. Since the FT accuracy is 18, after your transaction, the FT becomes 2.999999999999999999. At this time, you There are only 2 NFTs left, and the other one was burned and recycled and is waiting to be released to the counterparty. Another thing that disappears is gas. Therefore, ERC404 has also developed a whitelist mechanism so that some pairs/routers do not have to deal with NFT frequently. They can just handle the FT transaction. Anyway, the accounts are in the contract and cannot disappear. Finally, the owner may disappear. If revokeOwnership is executed, the subsequent whitelist mechanism will no longer be updated. The new mechanism will definitely bring new security risks. If a protocol fails to handle the double-sided coin mechanism of ERC404, it may bring unexpected consequences. It should also be noted that ERC404 is not yet a mature standard. I looked at the contract codes of several projects and there will be some modifications, so this is also a possible risk, a security risk caused by differences. "