KINKA Website security record

In the contract `BatchTransferable` the role `_owner` has authority over the functions. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and stop the batch transfer. In the contract `ERC20Token` the role `_owner` has authority over the functions. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - transfer tokens for a specified address through `sendTokens()` - transfer tokens to multiply users through `batchTransfer()` - burn token through `burn()` - burn token of an address through `burnFrom()` In the contract `ERC20TokenCrowdsale` the role `_owner` has authority over the functions. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - send tokens and set token lockup status to a specific user through `giveToken()` - send tokens to multiple users through `batchTransfer()` - set lockup status to multiple users through `batchUpdateLockupList()` - update lockup status for purchaser through `updateLockupList()` - update lockup time through `updateLockupTime()` - update rate through `updateRate()` - update minimum amount through `updateMinimumAmount()` - mint tokens to any address through `mint()` - mint stop through `finishMinting()` - burn token through `burn()` - burn token of an address through `burnFrom()` In the contract `GroupLockup` the role `_owner` has authority over the functions. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - update lockup status for purchaser through `updateLockupList()` - update lockup time through `updateLockupTime()` In the contract `WhiteList` the role `_owner` has authority over the functions. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - import the user's address into the whitelist or remove the user's address from the whitelist through `importList()` - update whitelist-able status in presale through `updatePresaleWhitelistStatus()` - update whitelist-able status in the public sale through `updatePublicSaleWhitelistStatus()`

`482` tokens were sent to the `ownerWallet` when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

1. In the function `transfer()`, the sender can only transfer token after the lockup date, but in the function `batchTransfer()` do not check the `_from`'s lockup status and locked date. 2. No tokens are sent when the purchaser buys pre-sold tokens in the function `buyTokens()`. 3. The function `giveToken()` can only add a user to the lockup list or update the lockup time, but can not remove the user from the lockup list. 4. Some library code, e.g. `MintableToken` has been deprecated. It is recommended to use the most recent version.