SlowMist Says ERC721R Sample Contract Flaw is Essentially Due to Excessive Owner Privileges

Core Go Pocket developer Ben said a flaw in the ERC721R sample contract could be exploited by the project to perform RugPull. According to the preliminary analysis of the SlowMist security team, this flaw is essentially due to the problem of excessive owner permissions. In the ERC721R example contract, the owner can arbitrarily set the NFT address returned by the user via the setRefundAddress function.