Equeus - Audit

### EqueusCareerPlan In the contract `EqueusCheckout` the role `onlyOperator` has authority over the following functions: - `addUserToPlan()` - `removeUserFromPlan()` - `emptyPlan()` - `airdropPlan()` Any compromise to the `onlyOperator` accounts may allow the hacker to take advantage of this authority and add or remove users from the plan and airdrop rewards to the current users in the plan. --- ### EqueusCheckout In the contract `EqueusCheckout` the role `TRANSACTION_FEE_ADDRESS` has authority over the functions shown in the diagram below. Any compromise to the `TRANSACTION_FEE_ADDRESS` account may allow the hacker to take advantage of this authority and set the `TRANSACTION_FEE_ADDRESS` to any address they want.  --- In the contract `EqueusCheckout` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - change the service fee addresses to any address they want; - change if KYC is enabled/disable, which determines if a sponsor receives commisions if they have not completed a KYC; - change if the checkout is open, which determines if users can purchase mystery packs; - set a users credits to any value, allowing them to use any USD held by the contract to purchase mystery packs with credits.  --- ### EqueusFairDraw In the contract `EqueusFairDraw` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - change the `VRF` settings with the functions `setNumWords()`, `setKeyHash()`, `setCallbackGasLimit()`, `setSubscriptionId()`, and `setRequestConfirmations()` which can be used to prevent the processing of opening mystery packs; - change the track and skin probabilities, to either increase or decrease the odds of a mystery pack containing the respective NFT.  --- In the contract `EqueusFairDraw` the role `onlyOperator` has authority over the function `closeLotteryPool()`. Any compromise to the `onlyOperator` account may allow the hacker to take advantage of this authority and close a lottery at a time other than the time it was intended to be closed at. --- ### EqueusMeritocraticPool In the contract `EqueusMeritocraticPool` the role `onlyOperator` has authority over the function `airdropRewards()`. Any compromise to the `onlyOperator` account may allow the hacker to take advantage of this authority and airdrop the rewards using any input `month` and `year` that has not already been used. --- ### EqueusPioneersPool In the contract `EqueusPioneersPool` the role `onlyOperator` has authority over the function `airdrop()`. Any compromise to the `onlyOperator` account may allow the hacker to take advantage of this authority and airdrop the rewards whenever they like. -- ### EqueusLotteryPools In the contract `EqueusLotteryPools` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - change the pool months or years array, this can be used to re-run a lottery; - set the `nextRewardPoolIndex`, this can be used to re-run a lottery; - airdrop the prize to any winner index, this can be used to airdrop the prize to an account they control as opposed to the lottery winner.  --- ### EqueusMysteryPacks In the contract `EqueusMysteryPacks` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - change the base URI; - update existing mystery packs and add/remove mystery packs. In particular, this includes the ability to set/change the price, active lines, active lines expiration, and APY to whatever values the hacker wishes.  --- ### EqueusNFTsVault In the contract `EqueusNFTsVault` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage o