Hashflow security record

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. In the case where a malicious actor obtains control of the owner's wallet, privileged functionality can be exploited in a way that harms future users. Specifically, a malicious actor could call `updateHashflowRouter()` in `RenovaCommandDeck` or `RenovaCommandDeckSatellite` to change the router address to a malicious contract. After the router is updated, users that call `RenovaQuest.trade()` are subject to having their funds stolen by the malicious router contract. The following are all other cases of owner privileges: - `RenovaCommandDeck.uploadItemMerkleRoot()` - `RenovaCommandDeck.mintItemAdmin()` - `RenovaCommandDeckBase.createQuest()` - `RenovaCommandDeckBase.updateRenovaAvatar()` - `RenovaCommandDeckBase.updateRenovaItem()` - `RenovaAvatarBase.refreshMetadata()` - `RenovaAvatarBase.refreshAllMetadata()` - `RenovaItem.updateMinterAuthorization()` - `RenovaItem.mint()` - `RenovaItemBase.setDefaultRoyalty()` - `RenovaItemBase.setCustomBaseURI()` - `RenovaItemBase.refreshMetadata()` - `RenovaItemBase.refreshAllMetadata()` - `WormholeBaseUpgradeable.updateWormhole()` - `WormholeBaseUpgradeable.updateWormholeConsistencyLevel()` - `WormholeBaseUpgradeable.updateWormholeRemote()`

Function `lzReceive()` receives messages from LayerZero endpoint and proceeds without a duplication check on `quote.txid`, nor does the payload contains a nonce that can be checked. The necessity of this validation depends solely on the reliability of LayerZero.

The contract is serving as the underlying entity to interact with one or more third party protocols, such as LazyZero, WormHole. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as message replay or loss, increasing fees of third parties, etc. Furthermore, as indicated in the Hashflow documentation, there is a risk for an LP when contributing assets to a public pool run by a market maker whose pricing algorithm fails to be profitable or becomes insolvent. If market makers can price assets off-chain, there is also a risk that they submit a favorable quote to an insider. In other words, they could self-deal, leaving LPs unable to withdraw their assets. Hashflow indicates that they are addressing these risks by only working with market makers that have a proven track record in CeFi.