Wemix Retainer 141 GameServerNFT

The `setTokenURI` function is external and lacks access control, enabling any user to change the metadata URI of any token. ```solidity=72 function setTokenURI(uint256 tokenId, string memory metadataURI) external { _setTokenURI(tokenId, metadataURI); } ``` Attackers can alter the metadata of any token, leading to misinformation or inappropriate content.

If the address `newSuperAdmin` to be set as the admin role is the same as the current admin `msg.sender`, it will result in the admin role losing its administration authorization over the contract. ```solidity=100 function changeSuperAdmin(address newSuperAdmin) external { require(newSuperAdmin != address(0), "GameServerNFT: New super admin cannot be the zero address"); require(isSuperAdmin(msg.sender), "GameServerNFT: Invalid super admin or unauthorized"); grantRole(GAME_SERVER_SUPER_ADMIN, newSuperAdmin); revokeRole(GAME_SERVER_SUPER_ADMIN, msg.sender); emit SuperAdminRoleChanged(msg.sender, newSuperAdmin); } ``` This vulnerability arises because the function first grants the admin role to the new owner's address and then revokes the admin role from the current admin's address. However, if the new owner's address is the same as the current one without any proper validation, the admin role will be revoked prematurely, leading to the admin losing the authorization for contract administration.