feeCollector silently overwritten by arbitrary user

rotateToPublicKey (line 755): Sets feeCollector = latest.prerotatedKeyHash before calling transferOwnership. This function is permissionless, anyone can call it with the owner's public key (readable from on-chain events). However, the rotation always goes to the owner's pre-committed prerotatedKeyHash, so no unauthorized party gains control.

If the owner uses setFeeCollector to route fees to a separate cold wallet or multisig, any subsequent key rotation (or an arbitrary user calling rotateToPublicKey) resets feeCollector to the new owner address.

• Restrict rotateToPublicKey with onlyOwner modifier.
• Or make feeCollector to be controlled only by setFeeCollector.

Also adding require(exists, "Key log not initialized") would make an explicit revert rather than depending on downstream revert in transferOwnership(latest.prerotatedKeyHash);.

YadaCoin, Confirmed.

Zealynx, Fixed.