NFTBOOKS security record

In the contract `BookContract`, the role `admin` or `operator` has authority over the following functions: - function updateBaseURIConfig(): update the Base URI of the NFT. Also, the role `market` has authority over the following functions: - function mint(): mint an NFT to an arbitrary `to` address. - function updateTokenURI(): update the token URI of the NFT. In the contract `NFTBookMetadata`, the role `market` has authority over the following functions: - function updateTotalPublications(): update the number of total publications. In the contract `NFTBSBookFactory`, the role `admin` has authority over the following functions: - function adminUpdateImplementation(): update the contract implementations. Also, the role `creator` has authority over the following functions: - function createBookContract(): create a new book contract. In the contract `NFTBSConfig`, the role `admin` or `operator` has authority over the following functions: - function updateServiceFeeForPreorder(): update the `_serviceFeeForPreorder`. - function updateServiceFeeForSell(): update the `_serviceFeeForSell`. - function updateServiceFeeForRental(): update the `_serviceFeeForRental`. - function updateMaxPublicationOpeningRange(): update the `_maxPublicationOpeningRange`. - function updateMinRoyaltyForSell(): update the `_minRoyaltyForSell`. - function updateMaxRoyaltyForSell(): update the `_maxRoyaltyForSell`. - function updateMinRoyaltyForRental(): update the `_minRoyaltyForRental`. - function updateMaxRoyaltyForRental(): update the `_maxRoyaltyForRental`. - function updateMinNumberBooksForPublication(): update the `_minNumberBooksForPublication`. - function updateMaxNumberBooksForPublication(): update the `_maxNumberBooksForPublication`. - function updateMinTimeToExtendBeforeRentalExpired(): update the `_minTimeToExtendBeforeRentalExpired`. - function updateMinAllowedTimeToRepublish(): update the `_minAllowedTimeToRepublish`. - function updateMinPublicationFee(): update the `_minPublicationFee`. In the contract `NFTBSContractRegistry`, the role `admin` has authority over the following functions: - function setNFTBSToken(): update the NFTBS token contract. - function setTreasury(): update the treasury contract. - function setMarket(): update the market contract. Also, the role `admin` or `operator` has authority over the following functions: - function `setConfig`: update the NFTBS config contract. - function `updateBookFactory`: update the NFTBS factory contract. In the contract `NFTBSTreasury`, the role `owner` has authority over the following functions: - function withdrawFunds(): transfer any amount of `NFTBS` token to an arbitrary address. - function totalBalance(): view the current treasury's total balance. In the contract `NFTBooks`, the role `owner` has authority over the following functions: - function excludeFromReward(): exclude an account from the reward. - function includeInReward(): include an account into the reward. - function excludeFromFee(): exclude an account from the fee. - function includeInFee(): include an account into the fee. - function skipToSwapAndLiquify(): change the variable `_isSkippedToSwapAndLiquify[account]`. - function setMarketingWallet(): set the `marketingWallet`. - function setRewardsContract(): set the reward contract address. - function setMaxTxPercent(): set the `_maxTxAmount`. - function setSwapAndLiquifyEnabled(): set the variable `swapAndLiquifyEnabled`. - function restoreToSwapAndLiquify(): set the variable `swapAndLiquifyEnabled` to false. - function setNumTokensSellToAddToLiquidity(): set the variable `numTokensSellToAddToLiquidity`. - function setMaxTokenHolder(): set the variable `_maxTokenHolder`. - function setUniswapV2Router(): set the contract addresses of `uniswapV2Router` and `uniswapV2Pair`. - function setTaxFeePercent(): set the taxFee. - function getTaxFeePercent(): get the taxFee. - function setLiquidityFeePercent(): set the liquidityFee. - function getLiquidityFeePercent(): get the liquidityFee. - function setMarketingDivisorPercent(): set the marketingDivisorFee. - function getMarketingDivisorPercent(): get the marketingDivisorFee. - function setRewardDivisorFeePercent(): set the rewardDivisorFee. - function getRewardDivisorFeePercent(): get the rewardDivisorFee. - function setMigration(): set the migration contract address. - function withdrawMATIC(): to withdraw the ETH in the contract `NFTBooks`. Also, the role `migration` has authority over the following functions: - function getCurrentRate(): get the current rate. - function getReflection(): get the `_rOwned[account]` of a given account. In the contract `NFTBSBscTreasury`, the role `owner` has authority over the following functions: - function updateMerkleRoot(): update the merkleRoot. In the contract `NFTBSRewards`, the role `owner` has authority over the following functions: - function setRewardsToken(): set the reward token. - function setRewards(): set the reward amount of a given accoun

`BookContract`, `NFTBSBookFactory`, `NFTBSConfig`, `NFTBSContractRegistry`, `NFTBSMarket`, `NFTBSRolesContract`, `NFTBSTreasury`, `NFTBSBscTreasury`, `NFTBSRewards` and `NFTBooks` are upgradeable contracts, the proxy admin can upgrade the contract without the community's commitment. If an attacker compromises the account, the implementation of the contract can be changed and tokens from the contract can be drained.

The contract "NFTBooks" method "addLiquidity()" calls the `uniswapV2Router.addLiquidityETH` function with the `to` address specified as `owner()` for acquiring the generated LP tokens from the `NFTBS-WMATIC` pool. As a result, over time the `owner()` address will accumulate a significant portion of LP tokens. If the `owner()` is an EOA (Externally Owned Account), mishandling its private key can have devastating consequences for the project.