Summary

It is not possible to limit the maximum of 4 NFTs that can be pledged.

Vulnerability Details

The stake function of the Streets contract fails to retrieve the user's pledged quantity, thereby unable to restrict each user to pledge more than 4 NFTs, allowing users to pledge NFTs without limitations.

Impact

Users can bypass restrictions on pledging NFTs.

Tools Used

Manual audit

Recommendations

Add a mapping[address user => uint256 pledged quantity] to record the pledged quantity of each user, and check if the user's pledged quantity is greater than 4 in the stake function.