Vaporware

Rewards may be added to the `Rewards` contract in a number of different ways: 1. When minting liquid accessories through `LiquidAccessories.mintAccessories()` 2. Adding rewards directly through `Rewards.addRewardsForAccessory()` Malicious users may frontrun calls when others are adding these rewards by equipping the item immediately before the reward is added and unequipping immediately after. A user may also acquire the accessory as part of the front-running.

`defineBondingCurveParameter()` has the following requirement check: ``` require(bondingCurves[_accessoryId].curveParameter == 0, "Parameter already set"); ``` This means that the `curveParameter` can only be set once. This can potentially be an issue if the Vaporware team would either accidentally misconfigure the value of a certain accessory or would like to update the value of a certain accessory.

The contracts rely heavily on the `EIP-6551`, which has not officially been accepted yet. If changes are made to this standard before it is accepted, the contracts may not integrate well with other applications that expect the official standard to be used.

In order to validate the proper deployment and initialization of the contracts, it is a good practice to emit events. Also, any important state transitions can be logged, which is beneficial for monitoring the contract, and also tracking eventual bugs or hacks. Below, we present a non-exhaustive list of functions that could emit events to improve application management: 1. `LiquidAccessories.defineBondingCurveParameter()` 2. `LiquidAccessories.setAvatarContract()` 3. `SoulboundAccessories.setAvatarContract()` 4. `MiladyAvatar.setOtherContracts()` 5. `TokenGatedAccount.execute()`

If the owner renounces their ownership, all ownable contracts will be left without an owner. Consequently, any function guarded by the `onlyOwner` modifier will no longer be able to be executed.

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. The following instances have been identified: 1. `LiquidAccessories` 1. `owner`: Define the bonding curve parameter, which determines how expensive it is to mint the accessory. 2. `SoulboundAccessories` 1. `miladyAuthority`: Onboard the Milady and mint its canonical accessories. This role could technically choose not to onboard selective Milady NFT IDs.

The `defineBondingCurveParameter()` function allows setting of a curve parameter for every accessory. This curve paramter is used to calculate the price of the accessory needed for minting or refunded on burning. The following equation is used: ``` 0.005 ether + _curveParameter * _itemNumber * _itemNumber ``` As `_curveParameter` is an arbitrary constant, if set too high, the whole calculation can overflow and DoS the minting process.