Mayors

In the contract `token.sol` the role `owner` has authority over the functions shown below. Any compromise to the `owner` account may allow a hacker to take advantage of this authority and - mint tokens through `mint()` - mint tokens in batches to different recipients through `batchMint()`

In the contract `Lootbox` the role `owner` has authority over the functions shown below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and - mint a lootbox nft on any account and set its season through `mint()` - mint lootbox nfts in batches through `batchMint()` - update configuration through `updateConfig()` - transfer ownership through `transferOwnership()` In the contract `Lootbox` the role `marketplace` has authority over the functions shown below. Any compromise to the `marketplace` account may allow the hacker to take advantage of this authority and - mint a lootbox nft on any account and set its season through `mint()` - mint lootbox nfts in batches through `batchMint()`

In the contract `Marketplace` the role `owner` has authority over the functions shown below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and - update marketplace configuration through `updateConfig()` - add and set up new seasons of loot through `addNewSeasons()` - send loot boxes to any recipient through `sendLootboxes()` - add participants to buyer whitelist through `addToWhiteList()` - remove participants from the buyer whitelist through `removeFromWhiteList()`

In the contract `NFT` the role `owner` has authority over the functions shown below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and - update configuration through `updateConfig()` - transfer ownership through `transferOwnership()` - mint in batches through `batchMint()` The role `lootBox` has authority over the functions shown below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and - mint in batches through `batchMint()` The role `levelUpgradesAddress` has authority over the functions shown below. Any compromise to the `levelUpgradesAddress` account may allow the hacker to take advantage of this authority and - increase token level through `updateLevel()`

An opportunistic user may exploit the marketplace as follows: 1. Set an item for sale at a low price and approve the marketplace of its transfer 2. Sell or send the item away for certain benefits 3. Transfer it back through `buyItem()`