Red flag

Findings

• The owner can withdraw funds with buy().
• The owner can change the rules with setBaseURI().
• The owner can change the rules with setContractURI().
• The owner can change the rules with setMintOpen().
• The owner can change the rules with setUpgradeCosts().
• A hard-coded address can move funds through withdrawRevenue(), even after the owner renounces.

Privileged functions

Functions in the verified source that only some addresses may call.

buy() setBaseURI() setContractURI() setMintOpen() setUpgradeCosts() withdrawRevenue()

What to do

Do not send funds until you have read the source yourself. If there is no verified source, nobody can tell what this contract does.