Derify Protocol

In the contract `CommunityVestingVault` the role `_owner` has authority over the functions mentioned below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - lock any function centralizing functions through `lockFunction()` - unlock timelock on centralizing functions through `unlockFunction()` - add tokens that will be granted through `lockToken()` - add grants through `addGrant()` - revoke grants through `revokeGrant()` In the contract `PrivateVestingVault` the role `_owner` has authority over the functions mentioned below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - lock any function centralizing functions through `lockFunction()` - unlock timelock on centralizing functions through `unlockFunction()` - add tokens that will be granted through `lockToken()` - add grants through `addGrant()` - revoke grants through `revokeGrant()` In the contract `TeamVestingVault` the role `_owner` has authority over the functions mentioned below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - lock any function centralizing functions through `lockFunction()` - unlock timelock on centralizing functions through `unlockFunction()` - add tokens that will be granted through `lockToken()` - add grants through `addGrant()` - revoke grants through `revokeGrant()`

All of the derify protocol tokens are sent to five addresses when deploying the contract. This could be a centralization risk as the deployer can distribute these tokens without obtaining the consensus of the community.