Halo Wallet

In the contract `HaloToken`, the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following things: - `mint()`, mint tokens to specified addresses - `transferOwnership()`, transfer ownership - `renounceOwnership()`, give up ownership  In the contract `HaloToken`, the role `_pendingOwner` has authority over the functions shown in the diagram below. Any compromise to the `_pendingOwner` account may allow the hacker to take advantage of this authority and do the following things: - `acceptOwnership()`, get the ownership

In the contract `HaloToken`, the role `owner` has the authority to update the token balance of an arbitrary account without sanity restriction. Any compromise to the `owner` account may allow a hacker to take advantage of this authority and manipulate users' balances. For example, the attacker could also update his/her balance to a large number, sell these tokens, and cause the token price to drop.

All of the `2_100_000_000e18` tokens are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.