3525Lottery - Audit (Addendum)

In the contract `Lottery` the role `owner` has authority over the functions shown in the diagram below. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and update the manager address, withdraw contract funds and modify key parameters of the Lottery contract.  Furthermore, the role `Manager` has authority over the following functions: * `sendWhitelist()` * `setWhitelistCode()` * `setPublicWhitelist()` * `takeWhitelist()` * `takePublicWhitelist()` * `forceBindRecommender()` * `setPresale()` * `setPause()` * `allocateIdlePool()` Any compromise to the `Manager` account may allow the hacker to take advantage of this authority and modify the list of whitelisted addresses, pause the contract and modify other settings. In the contract `LotteryDescriptor` the role `owner` has authority over the `registerSlot()` function. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and register new slots. In the contract `LotterySFT` the role `owner` has authority over the `setMetadataDescriptor()` function. Any compromise to the `owner` account may allow the hacker to take advantage of this authority and update the `metadataDescriptor` address. Furthermore, the role `Manager` has authority over the functions `mint()` and `burn()`. Any compromise to the `Manager` account may allow the hacker to take advantage of this authority and mint and burn LotterySFT tokens arbitrarily. Finally, all functions in the `Arithmetic` contract were found to be privileged (only callable by the owner address), but of the `view` type.