Lendr Network

### BorrowerOperations In the contract `BorrowerOperations` the role `_owner` has authority over the function `setAddresses()`. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the contract addresses to contracts that may allow them to steal funds. This function can only be called once, so that after the contracts are set users should verify them to be the intended contracts. In the contract `BorrowerOperations` the role `deployer` has authority over the function `toggleAfterPresale()`. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and call `togglePresale()` before the presale is ended to allow functions to be called before they are intended to be or not call the function to prevent users from opening troves. --- ### InflationFeed In the contract `InflationFeed` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - change the oracle to a malicious oracle that will manipulate the `targetPeg` by the maximum amount allowed; - withdraw all link held by the contract, so that the oracle fee will not be paid and the `targetPeg` will not be updated; - change the fee to an amount smaller than the required fee, so that the `targetPeg` will not be updated; - change the `jobId` so that it fetches a value other that the US CPI to manipulate the `targetPeg` by the maximum amount allowed; - change the address of LINK to prevent fees from being paid and prevent `targetPeg` from being updated.  --- ### PriceFeed In the contract `PriceFeed` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the contract addresses to contracts that may allow them to manipulate the price to steal funds. This function can only be called once, so that after the contracts are set users should verify them to be the intended contracts.  --- ### TroveManager In the contract `TroveManager` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the contract addresses to contracts that may allow them to steal users funds. This function can only be called once, so that after the contracts are set users should verify them to be the intended contracts. 

All of the `LNDR` tokens are sent several externally-owned account (EOA) addresses. This is a centralization risk because the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.