Sandbox L1

In the contract `LandBaseToken`, the role `_admin` has authority over the following functions: - `setMinter()`: Decide if an address is a minter or not; In addition, the `minter` role has authority over the following function: - `mintQuad()`: mints quads to an address. Also, the roles `superOperator` and `_metaTransactionContracts` have authority over the following functions: - `transferQuad()`: Transfer any user's quads to an address; - `batchTransferQuad()`: Transfer any user's quads to an address. The contract `LandBaseToken` inherits the contract `ERC721BaseToken`, where `_admin` has authority over the following functions: - `setMetaTransactionProcessor()`: Give or remove the `_metaTransactionContracts` role to or from an address; - `setSuperOperator()`: Give or remove the `superOperator` role to or from an address; - `changeAdmin()`: Change the address of the role `_admin`. In addition, the `superOperator` role has authority over the following functions: - `approveFor()`: Decide the allowance of any token; - `approve()`: Decide the allowance of any token; - `transferFrom()`: Transfer any user's tokens to an address; - `safeTransferFrom()`: Transfer any user's tokens to an address; - `batchTransferFrom()`: Transfer several of a user's tokens to an address; - `safeBatchTransferFrom()`: Transfer several of a user's tokens to an address; - `setApprovalForAllFor()`: Set the approval for an address to manage all of a user's tokens; - `burnFrom()`: Burn any user's tokens. Furthermore, the `_metaTransactionContracts` role has authority over the following functions: - `approveFor()`: Decide the allowance of any token; - `transferFrom()`: Transfer any user's tokens to an address; - `safeTransferFrom()`: Transfer any user's tokens to an address; - `batchTransferFrom()`: Transfer several of a user's tokens to an address; - `safeBatchTransferFrom()`: Transfer several of a user's tokens to an address; - `setApprovalForAllFor()`: Set the approval for an address to manage all of a user's tokens; - `burnFrom()`: Burn any user's tokens. Any compromise to the aforementioned privileged accounts may allow a hacker to take advantage of this authority and manipulate the reward system.