FlyingClub

In the contract, `PaperPlane`, the role, `_owner`, has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and disrupt the operation of the NFT token contract. 

The current implementation allows contract owner to bypass the sanity checks in `mint()` function and mint NFT tokens without paying. ```solidity= if (msg.sender != owner()) { if(onlyWhitelisted == true) { require(isWhitelisted(msg.sender), "user is not whitelisted"); } require(msg.value >= cost * _mintAmount, "insufficient funds"); require(supply + _mintAmount <= stageMaxSupply, "max NFT limit of this stage exceeded"); uint256 ownerMintedCount = addressMintedBalance[msg.sender]; require(ownerMintedCount + _mintAmount <= nftPerAddressLimit, "max NFT per address exceeded"); } for (uint256 i = 1; i <= _mintAmount; i++) { addressMintedBalance[msg.sender]++; _safeMint(msg.sender, supply + i); } ``` Any compromise to the `owner` account may allow the hacker to take advantage of this and over-mint NFT tokens which may damage the whole tokenomics.