TokenOps

The current access control based on having several addresses having the role `admin` can negatively impact the system: 1. If one admin address is compromised, it can become the only admin by removing all other admins; 2. One admin address can front-run actions from another admin. For instance, it can create a grant for an address by allocating tokens deposited to the contract for another grant about to be created. 3. One admin can revoke all active grants via the function `revokeGrant()` and withdraw the unlocked tokens via the function `withdrawAdmin()`. 4. One admin can withdraw the unrelated tokens sent to the contract via the function `withdrawOtherToken()` and keep them for himself. 5. The admin could front-run other admins in case of admin access removed by others. In this case, a malicious admin could not be removed. The root cause of this issue is that each admin can trigger an action, even if it is against the interest of the system and all other admins are against this action.

The function `withdrawOtherToken()` can be used by an address with the role `admin` to withdraw tokens from the contract which have a different address than the vested token having the address `tokenAddress`. However, an ERC20 token can have two addresses. Tokens with this special design are called "double-entry tokens". If such type of tokens would be vested by the current contract, using the secondary address would make it possible to drain allocated tokens from the vesting contract. The severity of this issue is assessed as low, because only the admin of the contract can execute this function and double-entry tokens are an uncommon design.