A Kid Called Beast

In the contract `AKCB` the role `_owner` has authority over the functions shown below. - `setVerificationHash()`: Set the hash of the "merkleroot". - `withdraw()`: withdraw the ethers to the owner's address. - `setNewRound()`: set all the information for the minting (such as the `Price`, `nftPerAddressLimit`). - `setURIManager()`: Set an address for the IPFS manager. - `setSaleStarted()`: Active/Deactivate the `mint()` function for buying the NFTs. - `setOnlyBeastListed()`: Activate/Deactivate the whitelist for sale. - `setTeamReserveAddr()`: Set the address of the `teamReserveAddr`. - `renounceOwnership()`: Transfer the ownership to the address(0). - `transferOwnership()`: Transfer the ownership of the contract to an arbitrary address. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and **withdraw** the funds from the contract or activate a sale with an unexpected price. --- In the contract `AKCB` the role `teamReserveAddr` has authority over the functions shown below. - `mintReserves()`: Mint any type of `AKCB` NFT. - `mintHoodReserve()`: Mint `AKCB` NFT with a certain type. Any compromise to the `teamReserveAddr` account may allow the hacker to take advantage of this authority and **mint** `AKCB` NFT to the same address. --- In the contract `AKCB` the role `uriManagerAddr` has authority over the functions shown below. - `setBaseURI()`: Set the `baseURI` of the project. Any compromise to the `uriManagerAddr` account may allow the hacker to take advantage of this authority and set an arbitrary URI for the project. As of Jan-26,2023, the contract is deployed at address [0x77372a4cc66063575b05b44481f059be356964a4](https://etherscan.io/address/0x77372a4cc66063575b05b44481f059be356964a4). The aforementioned roles are multisig addresses and corresponding addresses are listed below: - owner multisig: 0x81CC5b913A872bc815A8a84Ac08a55bC75d93c04 (require 3/4 approve) - eth:0x6a479db0E30C9d25B60E7FD1B9B6cdBbf7CeA20B - eth:0xFaf821dC2098D2266513959d9A60f97BfBDBCf91 - eth:0x24Dd9fc24d84C68C20a26D6f87160eF17064987A - eth:0xa7E68700499EbCC36a00C9a595f2AeFFb688041D - team reserve address: 0x263f8b4a146E85d8fd2BB42bE7fac5aaB0Ba3b7F (require 3/4 approve) - eth:0x6a479db0E30C9d25B60E7FD1B9B6cdBbf7CeA20B - eth:0xFaf821dC2098D2266513959d9A60f97BfBDBCf91 - eth:0x24Dd9fc24d84C68C20a26D6f87160eF17064987A - eth:0xa7E68700499EbCC36a00C9a595f2AeFFb688041D - uriManagerAddr: 0x81CC5b913A872bc815A8a84Ac08a55bC75d93c04 (require 3/4 approve) - eth:0x6a479db0E30C9d25B60E7FD1B9B6cdBbf7CeA20B - eth:0xFaf821dC2098D2266513959d9A60f97BfBDBCf91 - eth:0x24Dd9fc24d84C68C20a26D6f87160eF17064987A - eth:0xa7E68700499EbCC36a00C9a595f2AeFFb688041D