W3-Macondo

MacondoBFB --- In the contract `MacondoBFB` the role `MINTER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority and mint any amount of token to any address.  ---- In the contract `MacondoBFB` the role `PAUSER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `PAUSER_ROLE` account may allow the hacker to take advantage of this authority and pause or unpause the contract.  ---- In the contract `MacondoBFB` the role `UPGRADER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `UPGRADER_ROLE` account may allow the hacker to take advantage of this authority and potentially upgrade the logic implementation of the contract.  ---- ---- RandomOracleConsumer ---- In the contract `RandomOracleConsumer` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and request random words and get the random words corresponding to a specific request id.  ---- ---- PokerValidator --- In the contract `PokerValidator` the role `UPGRADER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `UPGRADER_ROLE` account may allow the hacker to take advantage of this authority and potentially upgrade the implementation of the contract.  ---- ---- TokenCollection --- In the contract `TokenCollection` the role `PAUSER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `PAUSER_ROLE` account may allow the hacker to take advantage of this authority and pause or unpause the contract.  ---- In the contract `TokenCollection` the role `WITHDRAW` has authority over the functions shown in the diagram below. Any compromise to the `WITHDRAW` account may allow the hacker to take advantage of this authority and drain `BNB` from the contract.  ---- In the contract `TokenCollection` the role `WITHDRAW_ERC20` has authority over the functions shown in the diagram below. Any compromise to the `WITHDRAW_ERC20` account may allow the hacker to take advantage of this authority and drain any ERC20 tokens from the contract.  ---- In the contract `TokenCollection` the role `WITHDRAW_ERC721` has authority over the functions shown in the diagram below. Any compromise to the `WITHDRAW_ERC721` account may allow the hacker to take advantage of this authority and steal ERC721 tokens from the contract.  ---- ---- MacondoTableNFT ---- In the contract `MacondoTableNFT` the role `MINTER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority and mint tokens to any address they want.  ---- In the contract `MacondoTableNFT` the role `PAUSER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `PAUSER_ROLE` account may allow the hacker to take advantage of this authority and pause or unpause the contract.  ---- In the contract `MacondoTableNFT` the role `UPGRADER_ROLE` has authority over the functions shown in the diagram

The linked contracts are upgradeable contracts, a privileged role can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

All `MacondoMCD` tokens are sent to the contract deployer when deploying the contract. This is a potential centralization risk as the deployer can distribute `MCD` tokens without the consensus of the community.

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable child should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.