Admin & upgrades

All three LootFi contracts are UUPS proxies with an owner. This page states exactly what that owner can do, and — just as importantly — what it cannot. Nothing here is hidden, because a reader who discovers an admin power on their own is right to distrust everything else on the site.

Owner powers

LootSkins

Function	Effect
updateMinter(address, bool)	Grants or revokes the right to mint
updateBaseURI(string)	Changes where token metadata is served from
setWithdrawFee(uint256)	Sets the per-token burn fee
setDefaultRoyalty(address, uint96)	Changes the ERC-2981 receiver and rate
withdrawFees(address payable)	Sweeps collected withdrawal fees
_authorizeUpgrade	Replaces the implementation

LootMarket

Function	Effect
setCollectionAllowed(address, bool)	Adds or removes a tradable collection
setCurrencyAllowed(address, bool)	Adds or removes a payment currency
setPlatformFee(uint16)	Changes the fee — capped at 10%, reverts above
setFeeRecipient(address)	Changes where the platform fee goes
pause() / unpause()	Halts or resumes all fills
_authorizeUpgrade	Replaces the implementation

LootToken

Ownership and _authorizeUpgrade. There is no post-initialization mint function, so the owner cannot increase the ERC-20 supply without an upgrade.

What owner control cannot do

Within the currently deployed implementations, the owner cannot:

• Transfer or burn your token. There is no admin transfer function. Burning requires direct ownership; even an approved operator cannot burn for you.
• Spend your marketplace approval arbitrarily. fulfillOrder moves a token only against a valid signature from that token's owner, with payment settled in the same transaction.
• Raise the platform fee above 10%. MAX_PLATFORM_FEE_BPS is a compile-time constant checked on every write.
• Take a token that has already been burned, or mint a duplicate of an existing id to a different recipient — see Minting.
• Change your ownership record. Ownership lives on-chain and is not mediated by any off-chain system.

The honest limit of that list

Every one of those guarantees holds for the currently deployed implementation. Because the contracts are upgradeable, an owner who chose to could deploy an implementation without them. Upgradeability is the root power; everything else follows from it.

What upgradeability actually means

UUPS means the upgrade authorization lives in the implementation itself and is gated by onlyOwner. In practice:

• The proxy addresses never change — the ones on Deployments are permanent.
• Storage layout is append-only. Existing slots are never reordered or reused, and storage gaps are reserved for future variables.
• An upgrade is a public on-chain transaction. It is observable by anyone watching the proxy, and it will be recorded in the changelog.

The marketplace approval consequence

This is the sharpest edge in the system, and it follows from gasless listings.

To sell without escrow you grant setApprovalForAll(LootMarket, true). That approval covers every LootSkins token in your wallet, present and future, and it persists until you revoke it.

The deployed marketplace can only act on that approval inside fulfillOrder, against a valid signature, with payment settled atomically. But an upgraded implementation would inherit the same approvals.

How to limit your exposure:

• Use a per-token approve(market, tokenId) instead of operator approval when you are only selling one item. LootMarket accepts either.
• Revoke with setApprovalForAll(market, false) when you are not actively selling. It costs one transaction and invalidates outstanding listings.
• Keep long-term holdings in a wallet that has never granted the approval.

This tradeoff is not unique to LootFi — it is how every gasless-listing marketplace works. It is stated plainly here so it is your decision rather than a surprise.

Ownership and the minter role are separate

Two distinct authorities, separately transferable:

• Owner — the admin functions above.
• Minter — an allow-list on LootSkins (isMinter) that can only mint.

Keeping them apart means the key that mints day to day is not the key that can upgrade contracts or move fees, and either can be migrated to a multisig without disturbing the other. Both are transferable by design so custody of these powers can harden over time.

Verifying the current state

RPC=https://rpc.mainnet.chain.robinhood.com
SKINS=0xcDc669a4A2EE3C01C0B269c990B4F0ae6BdCDA2E
MARKET=0xb455Da2D860FabCe8ee6B0DA96398c4CACf14229

cast call $SKINS  "owner()(address)"        --rpc-url $RPC
cast call $MARKET "owner()(address)"        --rpc-url $RPC
cast call $MARKET "paused()(bool)"          --rpc-url $RPC
cast call $MARKET "platformFeeBps()(uint16)" --rpc-url $RPC

# Is a specific address allowed to mint?
cast call $SKINS "isMinter(address)(bool)" <address> --rpc-url $RPC