# M-1
## Title
Possible DOS in `wrap`, `unwrap`, `_validateTokenIds` and methods that calls them because the number of tokenIds is not limited

## Links to affected code
https://github.com/code-423n4/2022-12-caviar/blob/main/src/Pair.sol#L238
https://github.com/code-423n4/2022-12-caviar/blob/main/src/Pair.sol#L258
https://github.com/code-423n4/2022-12-caviar/blob/main/src/Pair.sol#L468

## Impact
`wrap`, `unwrap`, `_validateTokenIds` methods takes tokenIds as a parameter but they don't hava a upper bound and this may lead to the gas limit and transactions will be failed or reverted.

Same issuse goes with `nftAdd`, `nftRemove`, `nftBuy` and `nftSell` because they call `wrap`, `unwrap` or `_validateTokenIds`.

## Proof of Concept
There are no upper bound for tokenIds and too many number of tokenIds might cause transactions to reach the gas limit.

// Pair.sol L238-L240
for (uint256 i = 0; i < tokenIds.length; i++) {
	ERC721(nft).safeTransferFrom(msg.sender, address(this), tokenIds[i]);
}

// Pair.sol L258-L260
for (uint256 i = 0; i < tokenIds.length; i++) {
	ERC721(nft).safeTransferFrom(address(this), msg.sender, tokenIds[i]);
}

// Pair.sol L468-L471
for (uint256 i = 0; i < tokenIds.length; i++) {
	bool isValid = MerkleProofLib.verify(proofs[i], merkleRoot, keccak256(abi.encodePacked(tokenIds[i])));
	require(isValid, "Invalid merkle proof");
}

## Tools Used
Manual Review

## Recommended Mitigation Steps
Set an upper bound for the length of `tokenIds`.

# L-1
Mediumか迷ってLowで出そうとしていますが、一旦載せておきます。 unchainとして提出しない場合は個人でlowとして提出しようと思います。

## Title
[L-AH-01] BaseToken cannot be withdrawn if LP token is lost.

## Summary
The baseToken sent to Pair contract by the `add` method can only be retrieved by calling the `remove` method; if the LP token is sent to a zero address, for example, the baseToken cannot be retrieved.

This is a valid issue because [the doc](https://github.com/code-423n4/2022-12-caviar/blob/main/docs/SECURITY.md#stuck-tokensnfts) does't say about LP token is stuck.