Auth Bypass: Inverted authorization check (private key mismatch allowed action) in three components, enabling attackers to confirm accounts, buy tokens, and submit votes without the correct key.

Auth Bypass: Missing private key verification allowed unauthorized transactions from any account; fix added pkToAddress equality check.

Business Logic Flaw: Allowed sending from the same address as destination, a business logic flaw enabling self-transfers or unintended token burns.