Megamoon - Audit

In the contract `MegamoonLottery` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and get DAO fee.  In the contract `MegamoonLottery` the role `operatorAddress` has authority over the functions shown in the diagram below. Any compromise to the `operatorAddress` account may allow the hacker to take advantage of this authority and repeatedly call `closeLottery` in a contract to try the best `finalNumber` by reverting bad `finalNumber`. 

In the contract `MegaMoonPilot` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, add & set the staking pool, update the reward multiplier， and emergency withdraws token.  In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer the ownership. 

In the contract `MegamoonDealer` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority，set the lottery address，fee setting，and transfer the contract's ERC tokens.  In the contract `MegamoonDealer` the role `lotteryAddress` has authority over the functions shown in the diagram below. Any compromise to the `lotteryAddress` account may allow the hacker to take advantage of this authority, inject the lottery and return fund from lottery. 

In the contract `RandomNumberGenerator` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change `keyHash` to impact the random number and withdraw LINK tokens. 

The contract is serving as the underlying entity to interact with third party ChainLink Random Oracle protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to be attacted. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, etc.