Infinity Angel

To bridge the gap in trust between the administrators need to express a sincere attitude regarding the considerations of the administrator teamʼs anonymity. In the contract `BoxPurchase`, the role `owner` has authority over the following functions: - set `foundationAddress` through `setFoundationAddress()` - set `verifier` through `setVerifier()` - pause the contract through `pause()` - unpause the contract through `unpause()` In the contract `BoxPurchase`, the role `verifier` has authority over the following functions: - purchase box through `purchaseBox()` In the contract `GameNFT`, the role `owner` has authority over the following functions: - pause the contract through `pause()` - unpause the contract through `unpause()` - mint nft to anyone through `safeMint()` - set tokenʼs `tokenUri` through `setTokenURI()` - set `marketAddress` through `setMarketAddress()` - burn token through `burn()` In the contract `MarketLogic`, the role `verifier` has authority over the following functions: - purchase ERC721 through `purchaseERC721()` In the contract `MarketLogic`, the role `owner` has authority over the following functions: - set `verifier` through `setVerifier()` - transfer anyone's NFT to anyone `transferHelperERC721()` - set `foundationAddress` through `setFoundationAddress()` - pause the contract through `pause()` - unpause the contract through `unpause()` In the contract `TransparentUpgradeableProxy`, the role `admin` has authority over the following functions: - view admin through `admin()` - view `implementation_` through `implementation()` - change admin through `changeAdmin()` - upgrade contract through `upgradeTo()` - upgrade contract and call function through `upgradeToAndCall()` In the contract `TokenPurchase`, the role `owner` has authority over the following functions: - set token list through `setListedToken()` - withdraw contract's ETH/BNB through `withdraw()` - pause the contract through `pause()` - unpause the contract through `unpause()` Any compromise to the key role account may allow a hacker to take advantage of this authority.

The Openzeppelin-upgrades are libraries that can deploy upgradeable contracts, upgrade deployed contracts, and manage proxy admin rights. The `BoxPurchase`, `GameNFT`, `MarketLogic`, and `TokenPurchase` are implemented based on the upgradeable contract, which can be updated by artificial control. Any updates should be taken seriously, uncertain updates may lead to losses.

The function `purchaseBox` accepts BNB/ETH or ERC20 tokens to purchase NFT, in this function only the user's tokens are transferred to `foundationAddress`, but NFT is not transferred to the user, there is only one event `BoxPaid`. And the parameter `orderData` is used without any reasonableness and security checks.

The parameter `orderData` of the function `purchaseERC721` is used without any reasonableness and security checks.

In the function `transferHelperERC721`, the owner can transfer anyone's NFT to anyone.

`public` functions that are never called by the contract could be declared `external`. When the inputs are arrays, `external` functions are more efficient than `public` functions.

The given input is missing the check for the non-zero address.

Functions that affect the status of sensitive variables should be able to emit events as notifications to customers. - `setFoundationAddress()` - `setVerifier()` - `changeProxyAdmin()` - `upgrade()` - `upgradeAndCall()` - `setVerifier()` - `transferHelperERC721()` - `setFoundationAddress()` - `withdraw()` - `setListedToken()` - `setMarketAddress()` - `setTokenURI()`

Malicious hackers may observe the pending transaction which will execute the `initialize` function and launch a similar transaction with the hacker's address.