WFCA Infrastructure security record

In the contract `TokenERC20` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and set critical variables.  --- In the contract `TokenERC20` the role `MINTER_ROLE` has authority over the function shown in the diagram below. Any compromise to the `MINTER_ROLE` account may allow the hacker to take advantage of this authority and mint tokens.  --- In the contract `AccessControlUpgradeable` the role `adminRole` has authority over the following functions: - grantRole() - revokeRole() Any compromise to the `adminRole` account may allow the hacker to take advantage of this authority and grant associated role to any account or revoke the role from any account. Note that `DEFAULT_ADMIN_ROLE` is the admin role for all roles. --- In the contract `AccessControlUpgradeable` the role `role` has authority over the following function: - renounceRole() Any compromise to the `role` account may allow the hacker to take advantage of this authority and renounce corresponding privileges to functions within other contracts.

The `TokenERC20` contract inherits from the `ERC2771ContextUpgradeable` contract. This design enables designated accounts, known as `_trustedForwarders`, to execute calls on behalf of any other account. If a `_trustedForwarder` is compromised, it could allow unauthorized actions on the contract, including operations associated with the `DEFAULT_ADMIN_ROLE`. Reference: [EIP-2771](https://eips.ethereum.org/EIPS/eip-2771)

On Sep 12, 2023, the addresses 0x4955b9aCfBAe877295965B73d08BD679D30fDa2e and 0x97224595072094aA8a2730cbB4261D42c70ab378 have all the WFCA tokens. This is a centralization risk because these addresses can distribute tokens without obtaining the consensus of the community. Any compromise to the addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=94 primarySaleRecipient = _primarySaleRecipient; ``` - `_primarySaleRecipient` is not zero-checked before being used. --- ```solidity=95 platformFeeRecipient = _platformFeeRecipient; ``` - `_platformFeeRecipient` is not zero-checked before being used. --- ```solidity=179 primarySaleRecipient = _saleRecipient; ``` - `_saleRecipient` is not zero-checked before being used. --- ```solidity=191 platformFeeRecipient = _platformFeeRecipient; ``` - `_platformFeeRecipient` is not zero-checked before being used.