VIM security record

In the contract `Ownable`, the role `_owner` has authority over the following functions: - renounceOwnership() - transferOwnership() Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and renounce or transfer the ownership. --- In the contract `VIUToken`, the role `_owner` has authority over the following functions: - mint() - mintTo() Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and mint tokens. --- Important Note: Certain identification and KYC procedures were attempted to be applied to the project team in order to better understand the centralization situation and potential risks of the project. Based on the collected information and further conducted investigation, the project passed the criteria with a certain amount of requirements satisfied for the investigation. Still we strongly advise end users to conduct further research and exercise due diligence before engaging with the project. It is crucial for end users to independently verify and assess all available information to make informed decisions.

A large number of VIU tokens are sent to the contract deployer when deploying the `VIUToken` contract. This could be a centralization risk as the anonymous deployers can distribute tokens without obtaining the consensus of the community. Any compromise to the deployer accounts that holds undistributed tokens may allow the attacker to steal and sell tokens on the market, resulting in severe damage to the project. --- Important Note: Certain identification and KYC procedures were attempted to be applied to the project team in order to better understand the centralization situation and potential risks of the project. Based on the collected information and further conducted investigation, the project passed the criteria with a certain amount of requirements satisfied for the investigation. Still we strongly advise end users to conduct further research and exercise due diligence before engaging with the project. It is crucial for end users to independently verify and assess all available information to make informed decisions.

A large number of VIZ tokens are sent to the contract deployer when deploying the `VIZToken` contract. This could be a centralization risk as the anonymous deployers can distribute tokens without obtaining the consensus of the community. Any compromise to the deployer accounts that holds undistributed tokens may allow the attacker to steal and sell tokens on the market, resulting in severe damage to the project. --- Important Note: Certain identification and KYC procedures were attempted to be applied to the project team in order to better understand the centralization situation and potential risks of the project. Based on the collected information and further conducted investigation, the project passed the criteria with a certain amount of requirements satisfied for the investigation. Still we strongly advise end users to conduct further research and exercise due diligence before engaging with the project. It is crucial for end users to independently verify and assess all available information to make informed decisions.

In the contracts `VIUToken`, the role `_owner` has the authority to mint an arbitrary amount of tokens to an arbitrary address. Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and mint a huge amount of tokens to themselves. The hacker could sell those tokens and cause the token price to drop. --- Important Note: Certain identification and KYC procedures were attempted to be applied to the project team in order to better understand the centralization situation and potential risks of the project. Based on the collected information and further conducted investigation, the project passed the criteria with a certain amount of requirements satisfied for the investigation. Still we strongly advise end users to conduct further research and exercise due diligence before engaging with the project. It is crucial for end users to independently verify and assess all available information to make informed decisions.

Weak PRNG due to a modulo on `block.timestamp`, `block.difficulty`, `msg.sender`, `block.coinbase`, `block.number`, `gasLeft` or `blockhash`. These can be influenced by miners to some extent, so they should be avoided. ```solidity=14 uint256 randomNumber = uint256(keccak256(abi.encodePacked(block.number, nonce, msg.sender, block.timestamp, block.difficulty))) % (_max - _min+1); ```