ParaSpace Lending V1 security record

In the contract `ACLManager`, the role `DEFAULT_ADMIN_ROLE` has authority over the following functions: - function setRoleAdmin(), to set the role as admin of a specific role. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow a hacker to take advantage of this authority. In the contract `PoolAddressesProvider`, the role `Owner` has authority over the following functions: - function setMarketId(), to associate an id with a specific PoolAddressesProvider. - function setAddress(), to set an address for an id replacing the address saved in the addresses map. - function setAddressAsProxy(), to update the implementation of a proxy registered with a certain `id`. If there is no proxy registered, it will instantiate one and set as implementation the `newImplementationAddress`. - function setPoolImpl(), to update the implementation of the Pool or creates a proxy setting for the new `pool` implementation when the function is called for the first time. - function setPriceOracle(), to update the address of the price oracle. - function setACLManager(), to update the address of the ACL manager. - function setACLAdmin(), to update the address of the ACL admin. - function setPriceOracleSentinel(), to update the address of the price oracle sentinel. - function setPoolDataProvider(), to update the address of the data provider. - function setWETH(), to update the address of the WETH. - function setMarketplace(), to update the info of the marketplace. Any compromise to the `Owner` account may allow a hacker to take advantage of this authority. In the contract `PoolAddressesProviderRegistry`, the role `Owner` has authority over the following functions: - function registerAddressesProvider(), to register an addresses provider. - function unregisterAddressesProvider(), to remove an addresses provider from the list of registered addresses providers. Any compromise to the `Owner` account may allow a hacker to take advantage of this authority. In the contract `PoolConfigurator`, the role `onlyPoolAdmin` has authority over the following functions: - function dropReserve(), to drop a reserve entirely. - function updatePToken(), to update the PToken implementation for the reserve. - function updateStableDebtToken(), to update the stable debt token implementation for the reserve. - function updateVariableDebtToken(), to update the variable debt token implementation for the asset. - function setReserveActive(), to activate or deactivate a reserve. Any compromise to the `onlyPoolAdmin` account may allow a hacker to take advantage of this authority. In the contract `PoolConfigurator`, the role `onlyRiskOrPoolAdmins` has authority over the following functions: - function setReserveBorrowing(), to configure borrowing on a reserve. - function configureReserveAsCollateral(), to configure the reserve collateralization parameters. - function configureReserveAsAuctionCollateral(), to configure the reserve collateralization parameters. - function setReserveStableRateBorrowing(), to enable or disable stable rate borrowing on a reserve. - function setReserveFreeze(), to freeze or unfreeze a reserve. A frozen reserve doesn't allow any new supply, borrow, or rate swap but allows repayments, liquidations, rate rebalances, and withdrawals. - function setReserveFactor(), to update the reserve factor of a reserve. - function setSiloedBorrowing(), to set siloed borrowing for an asset. - function setBorrowCap(), to update the borrowing cap of a reserve. - function setSupplyCap(), to update the supply cap of a reserve. - function setLiquidationProtocolFee(), to update the liquidation protocol fee of the reserve. - function setReserveInterestRateStrategyAddress(), to set the interest rate strategy of a reserve. Any compromise to the `onlyRiskOrPoolAdmins` account may allow a hacker to take advantage of this authority. In the contract `PoolConfigurator`, the role `onlyEmergencyOrPoolAdmin` has authority over the following functions: - function setReservePause(), to pause a reserve. A paused reserve does not allow any interaction (supply, borrow, repay, * swap interest rate, liquidate, NToken/PToken transfers). Any compromise to the `onlyEmergencyOrPoolAdmin` account may allow a hacker to take advantage of this authority. In the contract `PoolConfigurator`, the role `onlyEmergencyAdmin` has authority over the following functions: - function setPoolPause(), to pause or unpause all the protocol reserves. In the paused state all the protocol interactions are suspended. Any compromise to the `onlyEmergencyAdmin` account may allow a hacker to take advantage of this authority. In the contract `PoolConfigurator`, the role `onlyAssetListingOrPoolAdmins` has authority over the following functions: - function initReserves(), to initialize multiple reserves. Any compromise to the `onlyAssetListingOrPoolAdmins` account may allow a hacker to take advantage of this authority. In the contract `PoolParameters`, th

In the contract `Pool`, the role `onlyPoolAdmin` has authority over the following functions: - function rescueTokens(), to transfer any ERC20 tokens in the contract to any `to` address. Any compromise to the `onlyPoolAdmin` account may allow a hacker to take advantage of this authority. In the contract `Pool`, the role `onlyPoolConfigurator` has authority over the following functions: - function initReserve(), to initialize a reserve, activate it, assign an `NToken`/`PToken` and debt tokens and an interest rate strategy. - function dropReserve(), to drop a reserve. - function setReserveInterestRateStrategyAddress(), to update the address of the interest rate strategy contract. - function setReserveAuctionStrategyAddress(), to update the address of the auction strategy contract. - function setReserveDynamicConfigsStrategyAddress(), to update the address of the dynamic configs strategy contract. - function setConfiguration(), to set the configuration bitmap of the reserve as a whole. - function setAuctionConfiguration(), to set the auction configuration bitmap of the reserve as a whole. - function setMaxAtomicTokensAllowed(), to set the maximum allowed atomic tokens per user. Any compromise to the `onlyPoolConfigurator` account may allow a hacker to take advantage of this authority. In the contract `ACLManager`, the role `DEFAULT_ADMIN_ROLE` has authority over the following functions: - function setRoleAdmin(), to set the role as admin of a specific role. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow a hacker to take advantage of this authority. In the contract `PoolAddressesProvider`, the role `Owner` has authority over the following functions: - function setMarketId(), to associate an id with a specific PoolAddressesProvider. - function setAddress(), to set an address for an id replacing the address saved in the addresses map. - function setAddressAsProxy(), to update the implementation of a proxy registered with certain `id`. If there is no proxy registered, it will instantiate one and set as implementation the `newImplementationAddress`. - function setPoolImpl(), to update the implementation of the Pool or creates a proxy setting for the new `pool` implementation when the function is called for the first time. - function setPriceOracle(), to update the address of the price oracle. - function setACLManager(), to update the address of the ACL manager. - function setACLAdmin(), to update the address of the ACL admin. - function setPriceOracleSentinel(), to update the address of the price oracle sentinel. - function setPoolDataProvider(), to update the address of the data provider. - function setWETH(), to update the address of the WETH. - function setMarketplace(),to update the info of the marketplace. Any compromise to the `Owner` account may allow a hacker to take advantage of this authority. In the contract `PoolAddressesProviderRegistry`, the role `Owner` has authority over the following functions: - function registerAddressesProvider(), to register an addresses provider. - function unregisterAddressesProvider(), to remove an addresses provider from the list of registered addresses providers. Any compromise to the `Owner` account may allow a hacker to take advantage of this authority. In the contract `PriceOracleSentinel`, the role `onlyPoolAdmin` has authority over the following functions: - function setSequencerOracle(), to update the address of the sequencer oracle. Any compromise to the `onlyPoolAdmin` account may allow a hacker to take advantage of this authority. In the contract `PriceOracleSentinel`, the role `onlyRiskOrPoolAdmins` has authority over the following functions: - function setGracePeriod(), to update the duration of the grace period. Any compromise to the `onlyRiskOrPoolAdmins` account may allow a hacker to take advantage of this authority. In the contract `PoolConfigurator`, the role `onlyPoolAdmin` has authority over the following functions: - function dropReserve(), to drop a reserve entirely. - function updatePToken(), to update the PToken implementation for the reserve. - function updateStableDebtToken(), to update the stable debt token implementation for the reserve. - function updateVariableDebtToken(), to update the variable debt token implementation for the asset. - function setReserveActive(), to activate or deactivate a reserve. Any compromise to the `onlyPoolAdmin` account may allow a hacker to take advantage of this authority. In the contract `PoolConfigurator`, the role `onlyRiskOrPoolAdmins` has authority over the following functions: - function setReserveBorrowing(), to configure borrowing on a reserve. - function configureReserveAsCollateral(), to configure the reserve collateralization parameters. - function configureReserveAsAuctionCollateral(), to configure the reserve collateralization parameters. - function setReserveStableRateBorrowing(), to enable or disable stable rate borrowing on a reserve. - function setR