Uplift security record

In the contract `BaseRefundClaimer` the role `DEFAULT_ADMIN_ROLE` has authority over the `_authorizeUpgrade()` function. \ Any compromise to the `DEFAULT_ADMIN_ROLE` account will not have a direct impact in this context because the `_authorizeUpgrade()` function is an internal view function. In the contract `BaseRefundClaimer` the role `ROLE_REFUND_CLAIMER` has authority over the `claimRefundForAccount()` function. \ Any compromise to the `ROLE_REFUND_CLAIMER` account may allow the hacker to take advantage of this authority and trigger refunds of other users through the `claimRefundForAccount()` function. In the contract `OneChainRefundClaimer` the role `DEFAULT_ADMIN_ROLE` has authority over the functions below: - `setRefundRequester()` : Configure the `refundRequester` variable (`IBaseRefundRequester` contract); - `setIDOToken()` : Configure the IDO token. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and call `setRefundRequester()`, which would modify the `IBaseRefundRequester` contract. In the contract `BaseRefundRequester` the role `DEFAULT_ADMIN_ROLE` has authority over the functions below: - `_authorizeUpgrade()` : Internal view; - `setRefundable()` : Configure whether a KPI is refundable or not; - `setProjectFundsHolder()` : Configure the project's funds holder for refund; - `setKPI()` : Configure a KPI. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and modify the KPIs. In the contract `BaseRefundVesting` the role `DEFAULT_ADMIN_ROLE` has authority over the functions below: - `_authorizeUpgrade()` : Internal view; - `setRefund()` : Configure the `refundOf[token_][identifier_]` variable (`IBaseRefundRequester` contract). Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and make an IDO refundable or not. In the contract `OneChainDatesRefundVesting` the role `DEFAULT_ADMIN_ROLE` has authority over the `addTokenInfo()` function. \ Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority by modifying the `refundOf` and `vestingDataByToken` state variables.

`BaseRefundClaimer`, `BaseRefundRequester` and `BaseRefundVesting` are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, the attacker can change the implementation of the contract and drain tokens from the contract.