diff --git a/packages/world-module-metadata/test/MetadataModule.t.sol b/packages/world-module-metadata/test/MetadataModule.t.sol
index c8a152c0e2..4fcc5a92c3 100644
--- a/packages/world-module-metadata/test/MetadataModule.t.sol
+++ b/packages/world-module-metadata/test/MetadataModule.t.sol
@@ -40,7 +40,6 @@ contract MetadataModuleTest is Test, GasReporter {
     world.installModule(metadataModule, new bytes(0));
 
     // Transferring the namespace to the module and installing should be a no-op/idempotent and the module will return namespace ownership.
-    // TODO: is this a security concern? could someone frontrun by putting a tx in between the two calls below?
     world.transferOwnership(namespace, address(metadataModule));
     world.installModule(metadataModule, new bytes(0));
     assertEq(NamespaceOwner.get(namespace), address(this));
diff --git a/packages/world-module-metadata/ts/build.ts b/packages/world-module-metadata/ts/build.ts
index f3c950160a..9f24536f54 100644
--- a/packages/world-module-metadata/ts/build.ts
+++ b/packages/world-module-metadata/ts/build.ts
@@ -8,6 +8,7 @@ import { worldgen } from "@latticexyz/world/node";
  */
 
 // TODO: move tablegen/worldgen to CLI commands from store/world we can run in package.json instead of a custom script
+//       (https://github.com/latticexyz/mud/issues/3030)
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const configPath = "../mud.config";