Memeland

In the contract `MemecoinFiresaleV1` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and perform, including but not limited to, the following: - Modify the state of the Firesale at will. - Change the address of the `signer`. - Change the address of the `upgrader`. - Withdraw a certain amount of ETH that is available when the firesale is `FINISHED`. - Modify the `unitPrice` and `bulkSaleUnits` price. - Set a different contract upgrader. - Modify the refund start date to any date. - Withdraw the unclaimed refund.  Moreover, the `signer` account has the authority to authorize the `reserve` and `refund` calls by eligible accounts by issuing valid signatures. Any compromise to this authority may allow an hacker to leverage it and authorize the reserve and the refund to arbitrary accounts. In the contract `MemecoinClaim` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and: - Arbitrarily set a start claim date. - Withdraw the contract reserves. - Alter the claim schedule. - Add basis points for a claim type. - Add new addresses eligible for the claim. - Set a different claim token address. - Add new claimable NFT tokens. - Airdrop NFT and fungible tokens. - Set a different contract upgrader.  In the contract `Memecoin` the role `_owner` has authority over the function `setTokenPool`. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and modify the `tokenPool` address at will.

In the contracts `MemecoinFiresaleV1` and `MemecoinClaim` the account `upgrader` has the authority to update the implementation contract. Any compromise to the `upgrader` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the proxy contract storage.

All of the tokens tokens are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.