flexUSD security record

As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/b4f87bb8fc25fb07f73099701e39e167a3d36465/contracts/token/ERC20/ERC20.sol#L71-L78), as with other ERC20 tokens. ** 2020-12-14 update **: Two functions `increaseAllowance` and `decreaseAllowance` are added and recommended to be used by end users.

In `transferFrom()`, the allowance of `msg.sender` is expected to be reduced after the transfer operation takes place via the proxy of the msg.sender, according to ERC20 standard. Given that this was one of the requirements of the specifications, we will hold this codebase to this standard. In this case, the allowance was reduced with `_approve()` method. This is highly unusual, as it is not a typical setter method for the allowance mapping as one would expect, given that the name `_approve()` suggesting that this is an additional action. At the same time. `_approve()` emits two events which could be very misleading to an off-chain observer, who may think or regard that a new allowance was set instead of a transfer event happening which is what is taking place. ** 2020-12-14 update **: CoinFlex team decided to keep the calling of the function `_approve` and remove one of the event emits.

Smart contracts often have special roles to designate entities with privileges to make modifications to smart contracts. In this project, the admin can arbitrarily mint and burn tokens from/to any account and pause any accounts’ token transfer transactions. ** 2020-12-14 update **: CoinFlex team stated that it will be added to the documentation surrounding the contract.

The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability or may include intentionally or unintentionally modified upstream libraries. ** 2020-12-14 update **: the CoinFlex team does not regard QSP 4 to be related to security and stated that “it is useful to have a public repo with flattened code so that interested parties may compare that code directly to the necessarily flattened version available on a verified contract on Etherscan. In this context, it is a feature“.

In `truffle-config.js` and `buidler.config.js`, Infura API key is hardcoded. ** 2020-12-14 update **: CoinFlex team stated that these files will not be available in the public repo for the contracts.