LiquiFi security record

Certain contracts have state variables, e.g. `owner`, which provide certain addresses with privileged roles. Such roles may pose a risk to end-users. The contracts `CliffModule.sol`, `LinearModule.sol` and `StreamModule.sol` contain the following privileged roles: - `vestingControllerAddress`, as set by `setVestingController()` by the `owner` - Assign a new vesting controller or renounce their role by calling `setVestingController()`. - Create a plan, by calling `createPlan()`. - Update the book-keeping, by calling `release()`. - `owner`, set to `msg.sender` when `initialize()` is called - Same as `vestingControllerAddress`. - Assign a new `owner`, by calling `transferOwnership()` or renounce the ownership, by calling `renounceOwnership()`. Contract `EmployeeRegistry.sol` contains the following privileged roles: - `owner`, set to `msg.sender` when `initialize()` is called - Assign a new `owner`, by calling `transferOwnership()` or renounce the ownership, by calling `renounceOwnership()`. Contract `Escrow.sol` contains the following privileged roles: - `owner`, set to `msg.sender` when `initialize()` is called - Assign a new `owner`, by calling `transferOwnership()` or renounce the ownership, by calling `renounceOwnership()`. - Assign a new `vestingControllerAddress`, by calling `setVestingControllerAddress()`. - Retrieve the **public** address `vestingControllerAddress`, by calling `getVestingControllerAddress()`. - Deposit, by calling `deposit()`. - Withdraw, by calling `withdraw()`, bypassing any vesting schedules in the process. - Set or unset the paused state by calling `pause()` and `unpause()` respectively, therefore allowing or preventing calls to `deposit()` and `withdraw()`. - `vestingControllerAddress`, as initialized to `address(0)` or set by the `owner` when calling `setVestingControllerAddress()`: - Deposit, by calling `deposit()`. - Withdraw, by calling `withdraw()`.