Seedify.fund (nft-vanguards)

In the contract `BlackBoxVanguard` from the commit hash `58381fbee616cd801f73dde2d25dc6e8eacf11a6`, the role `_owner` has authority over the functions shown in the diagram below.  In addition, the `openBox()` function is callable when it is both the box owner and the `_owner` address. The `findBox()` is callable by the whitelisted addresses that can be verified by MerkleProof library, which are not defined in the scope of this contract. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority. --- In the contract `Vanguard` from the commit hash `58381fbee616cd801f73dde2d25dc6e8eacf11a6`, the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `Vanguard` from the commit hash `58381fbee616cd801f73dde2d25dc6e8eacf11a6`, the role `boxContractAddress` has authority over the functions shown in the diagram below. Any compromise to the `boxContractAddress` account may allow the hacker to take advantage of this authority.  --- Note that this finding is also applicable in the `dc1b4d74d3968e855911145c54adce7b6d82b040` commit. Please see the alleviation section for the functions changing details.

The contract is serving as the underlying entity to interact with third-party interface `IMagicEdenContract`. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. Note that this finding is also applicable in the `dc1b4d74d3968e855911145c54adce7b6d82b040` commit.