LootBox - executeCalls can be misused to relay calls
`LootBox` is deployed with `LootBoxController` and serves as the implementation for individual `create2` lootbox proxy contracts. None of the methods of the `LootBox` implementation contract are access restricted. A malicious actor may therefore use the `executeCalls()` method to relay arbitrary calls to other contracts on the blockchain in an attempt to disguise the origin or misuse the reputation of the `LootBox` contract (as it belongs to the PoolTogether project).\\nNote: allows non-value and value calls (deposits can be forces via selfdestruct)\\n```\\nfunction executeCalls(Call[] calldata calls) external returns (bytes[] memory) {\\n  bytes[] memory response = new bytes[](calls.length);\\n  for (uint256 i = 0; i < calls.length; i++) {\\n    response[i] = \\_executeCall(calls[i].to, calls[i].value, calls[i].data);\\n  }\\n  return response;\\n}\\n```\\n
Restrict access to call forwarding functionality to trusted entities. Consider implementing the `Ownable` pattern allowing access to functionality to the owner only.
```\\nfunction executeCalls(Call[] calldata calls) external returns (bytes[] memory) {\\n  bytes[] memory response = new bytes[](calls.length);\\n  for (uint256 i = 0; i < calls.length; i++) {\\n    response[i] = \\_executeCall(calls[i].to, calls[i].value, calls[i].data);\\n  }\\n  return response;\\n}\\n```\\n