Hinkal security record

Some contracts restrict critical operations to an `owner` role. The owner of the `VerifierFacade` contract controls the registered verifier contracts used for verifying ZK proofs. If the owner is compromised, the attacker can register a malicious contract that always returns `true` regardless of input. As a result, the ZK proof verification is disabled, and the attacker can claim that they own a commitment belonging to other users and transfer the funds to themselves. An overview of all privileged roles is as follows: **The contract `AccessToken.sol` gives the following privileges:** 1. The address `owner` can update the minting fee to an arbitrary value via the function `setMintingFee()`. 2. The address `owner` can blacklist an access key by removing it from the current Merkle Tree, via the function `blacklistAccessKey()`. After that, the blacklisted access key will not be able to submit a transaction to Hinkal. 3. The address `owner` can blacklist an address via the function `blacklistAddress()`. After that, the blacklisted address will not be able to add a new access token to Hinkal or to call the function `HinkalBase.register()`. 4. The address `owner` can remove an address from the blacklist via the function `blacklistAddress()`. 5. The address `owner` can withdraw all native tokens owned by the contract which represents the fee to mint an access token via the function `withdraw()`. 6. The address `owner` is used to authorize via a signature a new access token before it is added to the system via the function `addToken()`. **The contract `ERC20TokenRegistry.sol` gives the following privileges:** 1. The address `owner` can enable or disable the usage of the contract as a filter of ERC20 tokens in Hinkal transactions via the function `changeState()`. 2. The address `owner` can add a new token address to be supported for Hinkal transactions via the function `addERCToken()`. 3. The address `owner` can remove a token address to be supported for Hinkal transactions via the function `removeToken()`. 4. The address `owner` can set a limit to the amount of tokens that can be spent for a given token address in a Hinkal transaction via the function `setTokenLimit()`. **The contract `Hinkal.sol` gives the following privileges:** 1. The address `owner` can register an external action to be supported for Hinkal transactions via the function `registerExternalAction()`. After that, the address will be whitelisted and it will be possible to make an external call to that address in `Hinkal_internalRunExternalAction()`. 2. The address `owner` can revoke an external action to be supported for Hinkal transactions via the function `removeExternalAction()`. After that, it will be possible anymore to make an external call to that address in `Hinkal_internalRunExternalAction()`. **The contract `HinkalBase.sol` gives the following privileges:** 1. The address `owner` can register an arbitrary address to be the new `hinkalHelper` via the function `setHinkalHelper()`. After that, the result of core flows in the protocol can change based on the code of that new contract, since it stores: * The list of all registered access tokens; * The list of allowed relayers; * The list of allowed tokens, with their associated maximum limit; **The contract `RelayStore.sol` gives the following privileges:** 1. The address `owner` can update the relayer fee to a value between `0` and `500`, which means between `0` and `5%` via the function `setRelayPercentage()`. 2. The address `owner` can remove a relayer via the function `removeRelay()`. 3. The address `owner` can add or update an existing relayer via the function `addOrSetRelay()`. The relayer has two attributes: a `URL` and a `priority`. **The contract `VerifierFacade.sol` gives the following privileges:** 1. The address `owner` can add a new verifier contract based on its address and identified by a given ID to be supported by the contract via the function `registerVerifier()`. 2. The address `owner` can remove a verifier contract identified by a given ID to be supported by the contract via the function `removeVerifier()`.