IguVerse - Audit 1

In the contract `Iguverse` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and withdraw any BNB or BEP20 Tokens held by the contract, change the signer, change the base URI, or mint any quantity of tokens to themselves.  In addition if there is a compromise to the `signerRole` a hacker can sign messages enabling the use of `execTransaction()` to mint any quantity of tokens to themselves and transfer any BEP20 Tokens held by the contract to themselves. --- In the contract `TokenDistributor` the role `_owner` has authority over the `setSigner()` and `transferTo()` function. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and transfer tokens to anyone and grant the role of `singer` to any user. The role `singer` also has the authority over the `transferTo()` function. Any compromise to the `singer` account may allow the hacker to take advantage of this authority and transfer tokens to anyone. In addition to this, the signature of `singer` is required to call the `collect()` function. If the role of the `singer` is compromised it can lead to unintended users being able to sign messages enabling the use of `collect()` to transfer themselves tokens from the contract. --- In the contract `IgupToken` the role `_owner` has authority over `setMinter()` and `mintTo()` functions. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and mint themselves any amount of tokens. They may also assign the role of `minter` to anyone using the `setMinter()` function. The role `minter` also has the authority over the `mintTo()` function. Any compromise to the `minter` account may allow the hacker to take advantage of this authority and allow the hacker to mint themselves any amount of tokens. In addition to this, the signature of `minter` is required to call the `collect()` function. If the role of the `minter` is compromised, it can lead to unintended users being able to sign messages enabling the use of `collect()`to mint themselves any amount of new tokens.

`IGU`tokens are sent to `msg.sender` when deploying the contract. This could be a centralization risk as the `msg.sender` can distribute tokens without obtaining the consensus of the community.