Aptos Grant DAO-Audit

In the module `QF::qf`, the role `@QF` has authority over the following functions: - initialize() In the module `QF::qf`, the role `@QF`/`admin` has authority over the following functions: - start_round() - set_fund() - add_track() - batch_upload_project() - end_round() - withdraw_all() Any compromise to the `@QF`/`admin` account may allow a hacker to take advantage of this authority.

The `Aptos` chain supports code upgrades, which means deployed `Move` codes can be replaced by new codes. If a code upgrade occurs, all callers of the upgraded code will automatically call the new code the next time. For more details, please refer to [aptos-upgrade-policies](https://aptos.dev/guides/move-guides/upgrading-move-code/#upgrade-policies). If the `Aptos Grant DAO` project is deployed as upgradable, deployer account `QF` has permission to update the implementation of the module at it wishes. Any compromise to the deployer account `QF` may allow a hacker to take advantage of this authority to control the implementation of the program and thus execute potentially malicious functions in the module.

The `qf_tests` module is only used for testing. The `qf` module cannot be compiled successfully if it is not removed. File: qf.move ```rust=4 module QF::qf { friend QF::qf_tests; ... } ``` File: qf.test.move ```rust=1 #[test_only] module QF::qf_tests { ... } ```

Some variables are declared but never used.