Legend of Arcadia

In the contract `BaseToken` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority. - addBlackList(): add accounts to the blacklist. - removeBlackList(): remove accounts from the blacklist. - pause(): pause token functionality. - unpause(): unpause token functionality. - grantRole(): grant role to any account. - revokeRole(): revoke role from any account. In the contract `BaseToken` the role `CASHIER` has authority over the functions shown below. Any compromise to the `CASHIER` account may allow the hacker to take advantage of this authority. - mint(): mint tokens to any accounts that are not in the blacklist. - burn(): burn tokens from the role's account. --- In the contract `TokenFactory` the role `owner` has authority over the functions shown below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority. - deployToken(): deploy token contract. - transferOwnership(): transfer the ownership to the specified account. - renounceOwnership(): transfer the ownership to address(0).

A local variable is shadowing another component defined elsewhere. This means that when the contract accesses the variable by its name, it will use the one defined locally, not the one defined in the other place. The use of the variable may lead to unexpected results and unintended behavior. ```solidity=27 string memory _name, ``` - Local variable `_name` in `BaseToken.constructor` shadows the variable `_name` in `ERC20`. ```solidity=28 string memory _symbol, ``` - Local variable `_symbol` in `BaseToken.constructor` shadows the variable `_symbol` in `ERC20`. ```solidity=24 address _owner, ``` - Local variable `_owner` in `TokenFactory.deployToken` shadows the variable `_owner` in `Ownable`.

The cited address input is missing a check that it is not `address(0)`.