XP Network security record

Canister smart contracts are deployed and managed by controllers. Among other capabilities, the controllers can update the canister's settings, install/upgrade the running code or even delete the canister. Changing the code for the canisters they control so canister code is mutable, unlike smart contracts on other blockchains and the controllers have complete control over the assets like ICP tokens or Bitcoins held by the canister they manage. This feature brings canisters closer to typical software and makes them suitable for a broad range of applications where software logic can be changed on an as-needed basis. For critical applications like those used in DeFI, mutability can be dangerous; the controller could change a benign canister into a canister that steals assets.

In the `lib` contract, the `validator` role and accounts with the validator's signature have authority over the following functions: - set_pause(): set the contract state to pause, and other functions that cause contract data to be updated will not be executed; - set_group_key(): change the public key for canister signature verification; - withdraw_fees(): withdraw all ICP assets in the canister to any account; - add_whitelist(): add any NFT contract to the whitelist for cross-chain transfers; - clean_logs(): remove event logs; - validate_transfer_nft(): validator verifies the event and then mints NFT; - validate_unfreeze_nft(): validator verifies event and then unlocks NFT; - validate_transfer_nft_batch(): validator verifies event and then mints NFT in batch; - validate_unfreeze_nft_batch(): validator verifies event and then unlocks NFT in batch; Any compromise to the accounts with the signature may allow a hacker to take advantage of this authority, replace the public key, and transfer NFTs to anyone.