IOST

### IOSToken In the contract `IOSToken`, the role `_owner` has authority over the functions shown in the diagram below.  **Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and mint arbitrage tokens to a specific account, provided that the total supply remains within the configured cap (90,000,000,000).** ### Vesting In the contract `Vesting`, the role `_owner` has authority over the functions shown in the diagram below.  Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and revoke a vesting schedule, create a vesting schedule for a beneficiary, and withdraw a specified amount safely.

All initial IOSToken tokens (21,320,000,000) are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.