Realtoapps Smart Contract Audit

In the contract `BaseERC20` the role `BURNER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `BURNER_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `BaseERC20` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `BaseERC20` the role `MINTER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `BaseERC20` the role `REALTO_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `REALTO_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `BaseERC20` the role `SNAPSHOT_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `SNAPSHOT_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `BaseERC20` the role `_address` has authority over the functions shown in the diagram below. Any compromise to the `_address` account may allow the hacker to take advantage of this authority. 

In the contract `CrowdSales` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority.  In the contract `CrowdSales` the role `_aggregatorAddress` has authority over the functions shown in the diagram below. Any compromise to the `_aggregatorAddress` account may allow the hacker to take advantage of this authority.  In the contract `CrowdSales` the role `_erc20PaymentAddress` has authority over the functions shown in the diagram below. Any compromise to the `_erc20PaymentAddress` account may allow the hacker to take advantage of this authority. 

In the contract `DealToken` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority. 

In the contract `DividendExpat` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority. 

In the contract `DividendOffline` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority. 

In the contract `Marketplace` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority.  In the contract `Marketplace` the role `whiteListUsers` has authority over the functions shown in the diagram below. Any compromise to the `whiteListUsers` account may allow the hacker to take advantage of this authority. 

The contracts mentioned above are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

There are `initialMint` amount of tokens assigned to the `admin` when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

The contract is serving as the underlying entity to interact with one or more third-party protocols, like Chainlink. The scope of the audit treats third-party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc.