MorpheusAI

Summary

The MOR contract ownership is set to the L2MessageReceiver contract to allow minting, but it can't be modified.

Vulnerability Details

MOR token contract only allows the owner to mint tokens through the onlyOwner modifier.
As the minter is the L2MessageReceiver contract, it will also be the owner.

The ownership of the MOR contract can't be modified.
If for any reason, the minter needs to be modified, it will not be possible
because L2MessageReceiver doesn't have functionality to transfer
the MOR ownership.

Recommendations

Consider setting the admin of the project as the owner of the MOR token.

Then, create a minter role that is allowed to call the mint function
and set the L2MessageReceiver as the minter.