Rara

Certain contracts have state variables, e.g. `owner`, which provide certain addresses with privileged roles. Such roles may pose a risk to end-users. The `AddressManager.sol` contract contains the following privileged roles: - `ADDRESS_MANAGER_ADMIN`, as set by the `protocolAdmin` of `RoleManager.sol`: - Renounce his role and thereby disable all subsequently listed actions, by calling `RoleManager.renounceRole()`. - Change the role manager address (`roleManager`) to a new non-zero address that implements a `isAdmin()` function, by calling `setRoleManager()`. - Change the parameter manager address (`parameterManager`) to an arbitrary non-zero address, by calling `setParameterManager()`. - Change the maker registrar address (`makerRegistrar`) to an arbitrary non-zero address, by calling `setMakerRegistrar()`. - Change the reaction NFT contract address (`reactionNftContract`) to an arbitrary non-zero address, by calling `setReactionNftContract()`. - Change the default curator vault address (`defaultCuratorVault`) to an arbitrary non-zero address, by calling `setDefaultCuratorVault()`. - Change the L2 bridge registrar address (`childRegistrar`) to an arbitrary non-zero address, by calling `setChildRegistrar()`. The `RoleManager.sol` contract contains the following privileged roles: - `DEFAULT_ADMIN_ROLE`, as initialized to the parameter `protocolAdmin` during `initialize()`: - Renounce his role and thereby disable all subsequently listed actions, by calling `renounceRole()`. - Grant and revoke arbitrary roles (such as `ADDRESS_MANAGER_ADMIN`, `PARAMETER_MANAGER_ADMIN`, `REACTION_NFT_ADMIN`, `CURATOR_VAULT_PURCHASER` and `CURATOR_TOKEN_ADMIN`) to/of arbitrary addresses, by calling `grantRole()` and `revokeRole()`. The `ParameterManager.sol` contract contains the following privileged roles: - `PARAMETER_MANAGER_ADMIN`, as set by the `protocolAdmin` of `RoleManager.sol`: - Renounce his role and thereby disable all subsequently listed actions, by calling `RoleManager.renounceRole()`. - Change the accepted payment token to an arbitrary non-zero address, by calling `setPaymentToken()`. - Change the reaction price to an arbitrary non-zero value, by calling `setReactionPrice()`. - Change the cut of purchase price going to the curator liability (even above 100% - see input validation finding), by calling `setSaleCuratorLiabilityBasisPoints()`. - Change the cut of purchase price going to the referrer (even above 100% - see input validation finding), by calling `setSaleReferrerBasisPoints()`. - Change the cut of spend curator liability going to the taker (even above 100% - see input validation finding), by calling `setSpendTakerBasisPoints()`. - Change the cut of spend curator liability going to the referrer (even above 100% - see input validation finding), by calling `setSpendReferrerBasisPoints()`. - Add/Remove arbitrary non-zero addresses from the approved curator vault mapping, by calling `setApprovedCuratorVaults()`. - Change the sigmoid bonding curve parameters to arbitrary non-zero values, by calling `setBondingCurveParams()`. The `SigmoidCuratorVault.sol` contract contains the following privileged roles: - `CURATOR_VAULT_PURCHASER`, as set by the `protocolAdmin` of `RoleManager.sol`: - Renounce his role and thereby disable all subsequently listed actions, by calling `RoleManager.renounceRole()`. - Buy curator tokens when reactions are spent, by calling `buyCuratorTokens()`. The `CuratorToken115.sol` contract contains the following privileged roles: - `CURATOR_TOKEN_ADMIN`, as set by the `protocolAdmin` of `RoleManager.sol`: - Renounce his role and thereby disable all subsequently listed actions, by calling `RoleManager.renounceRole()`. - Mint tokens to an arbitrary address, by calling `mint()`. - Burn tokens of an arbitrary address, by calling `burn()`. The `ReactionNft1155.sol` contract contains the following privileged roles: - `REACTION_NFT_ADMIN`, as set by the `protocolAdmin` of `RoleManager.sol`: - Renounce his role and thereby disable all subsequently listed actions, by calling `RoleManager.renounceRole()`. - Mint tokens to an arbitrary address, by calling `mint()`. - Burn tokens of an arbitrary address, by calling `burn()`.