Ontact

In the contract `TokenLock` the role `_owner` has authority over the functions shown in the diagram below.  - `setERC20(address tokenAddress)`: Allows setting the address of the ERC20 token that will be managed by this contract. This function requires that the token address is not the zero address. It is a privileged function accessible only by the contract owner. - `unLock()`: This function is responsible for unlocking tokens according to the schedule defined in the contract. It iterates through the unlock schedule and transfers the unlocked tokens to the appropriate receiver address. It is a privileged function accessible only by the contract owner. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and update the sensitive settings and execute sensitive functions of the project.

All of the `OnTact` tokens are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.