Sabai Ecoverse Audit

### SabaiStaking In the contract `SabaiStaking` the role `_owner` has authority over the functions shown in the list below. * getReward() - Retrieve deposit rewards * getRestOfDeposits() - Transfer tokens in excess of deposits to the owner * stop() - Set the contract to expired and disable all deposits Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to control the status of the contract and transfer of funds. ### Ownable In the contract `Ownable` the role `_owner` has authority over the functions shown in the list below. * renounceOwnership() - Give up contract ownership * transferOwnership() - Transfer ownership to another address Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to control the ownership of contracts. ### Sabai Token In the contract `Sabai Token` the role `_owner` has authority over the functions shown in the list below. * setAntisnipe() - Set antisniping address * setIsAntisnipe() - Set antisniping status Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to set antisniping properties. ### Sabai Vesting In the contract `Sabai Vesting` the role `_owner` has authority over the functions shown in the list below. * createVestingSchedule() - Create new vesting schedule for a certain beneficiary * createVestingScheduleMany() - Create vesting schedules for multiple beneficiaries * revoke() - Ends specific vesting schedule * withdraw() - Withdraw amounts in excess of total vesting deposits Any compromise to the `_owner` account may allow the hacker to take advantage of this authority to control vesting schedules and withdraw tokens. --- The following content is based on the commit [93c47004157862c4d0b9967f83312aee278d4b36](https://github.com/Sabai-Ecoverse/contracts/tree/93c47004157862c4d0b9967f83312aee278d4b36). ### Sabai Staking In the contract `SabaiStaking` the role `_owner` has authority over the functions shown in the list below. * ChangeSabaiRewarderAddress() - Change the reward distribution address * stop() - Set the contract to expired and disable all deposits ### Sabai Vesting The client added a new role `ManagerAddress` to manage the actual business. In the contract `Sabai Vesting` the role `_owner` has authority over the functions shown in the list below. * changeManagerAddress() - change the manager address In the contract `Sabai Vesting` the role `ManagerAddress` has authority over the functions shown in the list below. * createVestingSchedule() - Create new vesting schedule for a certain beneficiary * createVestingScheduleMany() - Create vesting schedules for multiple beneficiaries * revoke() - Ends specific vesting schedule * withdraw() - Withdraw amounts in excess of total vesting deposits

All SABAI tokens are sent to the contract deployer when deploying the contract. This is a potential centralization risk as the deployer can distribute SABAI tokens without the consensus of the community.