Reality Metaverse security record

In the contract `AuctionHouse` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and drain tokens from the contract by calling function `emergencyMainExcessHandout` and `emergencyStableExcessHandout`.  In the contract `RealityVesting` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and drain tokens by calling function `emergencyWithdraw()` and adding allocation for a particular address by calling function `allocate()`.  In the contract `VoucherPayment` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and destruct the contract and drain tokens by calling function `close()`.  In the contract `TradeConfig` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the address of the fee recipient to an attacker-controlled address by calling functions `setFeeRecipient()`. In addition, attackers may add malicious contracts by calling function `supportItem()` or `supportTradeToken()`.  In the contract `RealityPropertiesChild` the role `DEPOSITOR_ROLE` has authority over the function `deposit()`. Any compromise to the `DEPOSITOR_ROLE` account may allow the hacker to take advantage of this authority and mint tokens to attacker-controlled addresses by calling function `deposit()`. In the contract `RealityPropertiesRoot` the role `MINTING_MANAGER` has authority over the function `safeMint()`. Any compromise to the `MINTING_MANAGER` account may allow the hacker to take advantage of this authority and mint tokens to attacker-controlled addresses by calling function `safeMint()`. In the contract `Trade`, the role `_owner` has authority over the functions `emergencyNFTWithdrawal()` and `emergencyTradeTokenWithdrawal()`. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and remove any tokens present in the contract.

The linked contracts are upgradeable contracts, and the owner can upgrade the contract without the community's consent. If an attacker compromises the account, they can change the implementation of the contract and drain tokens from the contract.