Decentraland

In the contract `ThirdPartyRegistry`, the role `owner` has the authority over the following functions: - `setThirdPartyAgregator()`, to set `thirdPartyAgregator`. - `setFeesCollector()`, to set `feesCollector`. - `setCommittee()`, to set `committee`. - `setAcceptedToken()`, to set `acceptedToken`. - `setItemTiers()`, to set `itemTiers`. - `setInitialThirdPartyValue()`, to set `initialThirdPartyValue`. - `setInitialItemValue()`, to set `initialItemValue`. The role `thirPartyAgregator` has the authority over the following functions: - `addThirdParties()`, to register a new third-party in the contract. - `updateThirdParties()`, to update the info of third parties. The role `committee` has the authority over the following function: - `reviewThirdParties()`, to review third parties. Any compromise to the `owner`, `committee`, `thirPartyAgregator` account may allow the hacker to take advantage of this.

In the contract `Tiers`, the role `owner` has the authority over the following function: - `updatePrices()`, to update the prices of tiers. - `addTiers()`, to add tiers. Any compromise to the `owner` account may allow the hacker to take advantage of this,

The function `updateThirdParties` allows the managers of the `thirdParty` to add others as managers or remove other managers. If untrusted users become the manager of the `thirdParty`, the `thirdParty` team may lose the control of it.

The contract is serving as the underlying entity to interact with third party `committee`, `acceptedToken`, `itemTier` protocols. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

The function `buyItemSlots()` does not require the caller is the manager of the third party. We would like to confirm with the client if the current implementation aligns with the original project design.