Ordify security record

In contract `AddressManagement`, the role `_owner` has authority over the following functions: - `addChain`: Add a new supported chain. - `renounceOwnership`: Leaves the contract without owner. - `transferOwnership`: Transfers contract ownership to a new account. In contract `Helper`, the role `_owner` has authority over the following functions: - `emergencyWithdrawToken`: Withdraw arbitrary tokens from the `Helper` contract, and the `Helper` contract should not store any tokens. - `renounceOwnership`: Leaves the contract without owner. - `transferOwnership`: Transfers contract ownership to a new account. In contract `Launchpad`, the role `_owner` has authority over the following functions: - `setGlobalRefundEnabled`: Activate/deactivate the global refund functionality. - `setRefundPercentage`: Set refund percentage value. **Note:** Since the refund percentage can be an arbitrary positive value, the user should understand the risk when the percentage is a lower value, which will cause the loss. - `prepareForGlobalRefund`: Set confgurations related to the refund. - `setRound2Multiplier`: Set new `round2Multiplier`. - `setSaleStartDate`: Set sale start date. - `setRound1Duration`: Set new `round1Duration`. - `finishSale`: Mark sake as finished. - `withdrawStable`: Collect stable token raised after the sale has ended. - `withdrawStableRefund`: Withdraw refund penalty from the contract after the sale end. - `emergencyWithdrawToken`: Withdraw arbitrary tokens from the contract. - `renounceOwnership`: Leaves the contract without owner. - `transferOwnership`: Transfers contract ownership to a new account. In contract `Staking`, the role `_owner` has authority over the following functions: - `addStakingDefinition`: Add new staking definition. - `setGlobalWithdrawFeeForStakingDefinition`: Update global withdraw fee for one staking definition. - `removeGlobalWithdrawFeeForStakingDefinition`: Disable global withdraw fee for one staking definition. - `setWithdrawFee`: Update withdraw fee. - `enableStakingDefinition`: Enable staking definition. - `disableStakingDefinition`: Disable staking definition. - `setName`: Set staking definition name. - `setTreasury`: Set treasury address, which will receive the withdrawal fee. - `setRate`: Set interest rate for staking. - `setLockDuration`: Set stake lock duration for staking definition. - `changeIsStoppedStatus`: Change stop status which relates to the stake function. - `emergencyWithdrawToken`: Withdraw arbitrary tokens from the contract. - `sync`: Sync the actual token balance. - `renounceOwnership`: Leaves the contract without owner. - `transferOwnership`: Transfers contract ownership to a new account. - `setPrematureWithdrawEnabled`: Enable/disable pre mature withdraw flag. In contract `Vesting`, the role `_owner` has authority over the following functions: - `reinitialize`: Reinitialize the vesting setup - `setRefundMode`: Set refund mode for vesting - `createVestings`: Create a vesting sechedule for the user. - `emergencyWithdrawToken`: Withdraw arbitrary tokens, other than vesting token, from the contract. - `withdrawRequestRefundToken`: Withdraw requested vesting tokens. - `withdrawRefundForAll`: Withdraw all vesting token. ***Important Note: Certain identification and KYC procedures were attempted to be applied to the project team in order to better understand the centralization situation and potential risks of the project. Based on the collected information and further conducted investigation, the project failed to pass the criteria with a certain amount of negative signals. Thus the case analysis concluded that there is potential high risk to the project. We strongly advise end users to conduct further research and exercise due diligence before engaging with the project. It is crucial for end users to independently verify and assess all available information to make informed decisions.***

The owner of the `Launchpad` contract has the ability to withdraw all stable tokens after the IDO via `emergencyWithdrawToken`. According to the design of `Launchpad` contract, the stable token is deposited by users for IDO purposes. If the owner's account is compromised, hackers can take advantage of this privileged functionality to steal users' assets. The owner of the `Staking` contract has the ability to withdraw all staking tokens during the deposit via `emergencyWithdrawToken`. If the owner's account is compromised, hackers can take advantage of this privileged functionality to steal users' assets. The following functions in the following contracts can also withdraw tokens, however, the limited restriction may implemented, or the contract is not intended to hold the token: - `Helper` contract: `emergencyWithdrawToken` - `Launchpad` contract: `withdrawStable` and `withdrawStableRefund` - `Vesting` contract: `emergencyWithdrawToken`(for non-vested token), `withdrawRequestRefundToken` and `withdrawRefundForAll`. Any compromise to the `owner` account may allow a hacker to take advantage of this authority and withdraw tokens from contracts. ***Important Note: Certain identification and KYC procedures were attempted to be applied to the project team in order to better understand the centralization situation and potential risks of the project. Based on the collected information and further conducted investigation, the project failed to pass the criteria with a certain amount of negative signals. Thus the case analysis concluded that there is potential high risk to the project. We strongly advise end users to conduct further research and exercise due diligence before engaging with the project. It is crucial for end users to independently verify and assess all available information to make informed decisions.***