PEAKDEFI

When migrating the `PeakDeFiFund` to a new version, `migrateOwnedContractsToNextVersion` function does not transfer the ownership of `peakReferralToken` which will break token deposit and withdrawal, since the new contract won't own the `peakReferralToken`.

Peak token cap is fixed to five billions, `_interestRateFactor` function is supposed to return zero rate after 5 billions cap. However, the function will throw instead since `SafeMath.sub` is used. As a consequence `PeakStaking` contract will be inaccessible after that the max cap is reached, disallowing new managers to join.

External signature won't work since `msg.sender` won't be equal to `address(this)`. As an example, if user A calls `PeakDefiFund.createInvestmentWithSignature` that does a delegate call to `PeakdefiLogic.createInvestmentWithSignature` the `msg.sender` value will still be equal to user A address, once all ECDSA verifications pass with the signature of user B, `createInvestmentV2` is called without using the keyword `this.createIn...` meaning that the `msg.sender` value will still be equal to the initial sender (user A), The requirements that checks if `msg.sender == _sender || msg.sender == address(this)` will throw since both condition are wrong. Affected function: - `PeakDefiLogic.createInvestmentWithSignature()`. - `PeakDefiLogic.sellInvestmentWithSignature()`. - `PeakDefiLogic.createCompoundOrderWithSignature()`. - `PeakDefiLogic.sellCompoundOrderWithSignature()`. - `PeakDefiLogic.repayCompoundOrderWithSignature()`.

As per the [specification](https://peakdefi.gitbook.io/peakdefi/for-investors/staking-peak) `PeakStaking._interestRateFactor` does not seem to implement "Bigger Bonus Daily".

`initTokenListings` does not check if the listed compound tokens are set in the compound order factory. Adding a token that is not listed may lead to unexpected behaviour.

`PeakdefiFactory` `createFund` and all initialisation functions do not implement any authorisation mechanism, depending on how often `PeakDefiFund`s are deployed, an attacker can front run a transaction to set initialisation parameters to its own.

The version of `@openzeppelin/contracts`, `@uniswap/v2-periphery`, and `@uniswap/v2-core` are not locked in `peakdefi-contracts` and the version of `@openzeppelin/contracts` is not locked in `peakDeFi-token`. This entails some risk of unexpected behaviours due to updates of contracts in these packages.