CAPTAIN TSUBASA -RIVALS- security record

In the project `Captain Tsubasa -RIVALS-`, three token contracts are implemented (`GT.sol`, `NFT.sol`, and `UTT.sol`) for the GameFi, which have adopted the following roles for access control. **`MINTER_ROLE`** - In the contract `NFT.sol`, the `MINTER_ROLE` has the authority to call `safeMint()` to **mint NFT tokens**. - In the contract `UTT.sol`, the `MINTER_ROLE` has the authotity to call `mint()` to **mint UTT tokens**. Any compromise to the `MINTER_ROLE`'s account may cause the unexpected minting of tokens and lead to tokenomic attacks. **`DEFAULT_ADMIN_ROLE`** - In the contract `GT.sol`, the `DEFAULT_ADMIN_ROLE` is adopted as the admin role to set up roles. - In the contract `NFT.sol`, the `DEFAULT_ADMIN_ROLE` is adopted as the admin role to set up roles and also has the authority to call `setBaseURI()` to set the URL of the NFT tokens. - In the contract `UTT.sol`, the `DEFAULT_ADMIN_ROLE` is adopted as the admin role to set up roles. Any compromise to the `DEFAULT_ADMIN_ROLE`'s account may allow attackers to grant significant roles to their controlled address. For example, the attacker can set his address as `MINTER_ROLE` to mint an unlimited amount of tokens. **`PAUSER_ROLE`** - In the contract `GT.sol`, the `PAUSER_ROLE` is adopted to pause the control in case of an emergency via `pause()` or `unpause()`. - In the contract `NFT.sol`, the `PAUSER_ROLE` is adopted to pause the control in case of an emergency via `pause()` or `unpause()`. - In the contract `UTT.sol`, the `PAUSER_ROLE` is adopted to pause the control in case of an emergency via `pause()` or `unpause()`. Any compromise to the `PAUSER_ROLE`'s account may allow attackers to pause the contract for Denial-of-Service attacks.

All GT tokens are sent to the contract deployer when deploying the contract. This is a potential centralization risk as the deployer can distribute GT tokens without the consensus of the community. ```solidity constructor( string memory name, string memory symbol, uint256 totalSupply ) ERC20(name, symbol) { _grantRole(DEFAULT_ADMIN_ROLE, msg.sender); _grantRole(PAUSER_ROLE, msg.sender); _mint(msg.sender, totalSupply * (10 ** decimals())); } ```