Owner controls

Findings

• The owner can withdraw funds with acceptBattle().
• The owner can withdraw funds with cancelBattle().
• A hard-coded address keeps special rights over onERC721Received(), even after the owner renounces.
• The owner can change the rules with pause().
• The owner can change the rules with unpause().
• The owner can withdraw funds with withdraw().

Privileged functions

Functions in the verified source that only some addresses may call.

acceptBattle() battle() cancelBattle() evolve() onERC721Received() pause() trainWithProof() unpause() withdraw()

What to do

Read the listed functions before you send anything. An active owner can change the rules after you mint.