Passpay

In the contract **Jpyw.sol**, the role **MINTER_ROLE** has authority over the following functions: - function `mint()` The role **BURNER_ROLE** has authority over the following functions: - function `burn()` The role **BLOCK_LIST_ROLE** has authority over the following functions: - function `addToBlockList()` - function `removeFromBlockList()` Any compromise to the privileged accounts may allow a hacker to take advantage of this authority and update the sensitive settings and execute sensitive functions of the project.

`Jpyw.sol` are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

One or more logic contracts do not protect their initializers. An attacker can call the initializer and assume ownership of the logic contract, whereby she can perform privileged operations that trick unsuspecting users into believing that she is the owner of the upgradeable contract. ```solidity=8 contract Jpyw is ERC20Upgradeable, AccessControlEnumerableUpgradeable { ``` - `Jpyw` is an upgradeable contract that does not protect its initializer. ```solidity=20 function initialize() external initializer { ``` - `initialize` is an unprotected initializer function.

The return value of an external call is not stored in a local or state variable. ```solidity=48 blockList.add(_account); ``` --- ```solidity=56 blockList.remove(_account); ``` In the `EnumerableSetUpgradeable.sol` in https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/utils/structs/EnumerableSetUpgradeable.sol, add() and remove() will return boolean type of value.