Smart contract NFT internal security audit

[sydhds]

Following the internal audit described here,

The following report has been written with few recommendations:

https://www.notion.so/massa-innoteam/FT-NFT-Contract-Audit-comments-0dd27b501ce44fcf9fbe131a7b6ebb8e?pvs=4#065acfb0b6bc4eba9e1a7070c8eb4636

Recommendations

Code Coverage and Testing

• Enable coverage automatically in as-pect.config.js.
• Enable coverage checks in the Continuous Integration (CI) pipeline.
• Update coverage to 100% in NFT.ts and NFT-internals.ts.
• Add npm audit to the CI pipeline to regularly check for package vulnerabilities.

Code Security and Best Practices

• In NFT-internals.ts, _increment: Check for u64 overflow.
• In NFT-internals.ts, _updateBalanceOf: Check for u64 overflow and reset.
• In NFT-internals.ts, _isTokenOwner: Revise the comment about memory.compare to clarify that the comparison is of byte contents, not pointers.
• In NFT-internals.ts, _setApprovalForAll: Store boolean values instead of strings (e.g., "true").
• In wrapper.spec.ts: Use assert to ensure that all return values are checked.

Dependencies Update

• Update the "semver" package as recommended by npm audit.