centralization-risklisted

# Centralization risk audit ## Why this matters Centralization findings are non-exploits in the traditional sense, but they're the most common reason audits flag a protocol as "rugpullable". The protocol can be the attacker. Investors deserve a clear inventory. ## When this applies - Every privileged function (mint, burn, set-fee, set-oracle, upgrade, pause, recover, sweep, blacklist) - Multi-sig configuration - Timelock configuration - Upgrade authority (UUPS `_authorizeUpgrade`) - Emergency-withdraw / emergency-pause - Token mint caps + upgradability of caps ## Detection patterns ### Single-key admin (HIGH) ```solidity contract X is Ownable { function upgradeTo(address impl) external onlyOwner { ... } function setFee(uint256 fee) external onlyOwner { ... } // ← one key, can pull rug } ``` Findings: - "Owner can upgrade implementation immediately, with no timelock or multi-sig." - "Single key controls treasury." ### No timelock (HIGH) `onlyOwner` upgrades / fee changes / oracle changes that take effect immediately. Add a Timelock (OZ TimelockController), document the delay. ### Pause-without-time-cap (HIGH) `pause()` with no auto-unpause. Owner can permanently freeze user funds. ### Mint without cap (HIGH) ```solidity function mint(address to, uint256 amt) external onlyMinter { _mint(to, amt); } // ← no cap, inflation risk ``` ### Blacklist without on-chain criteria (HIGH) A `blacklist(address)` function with no public criteria = "the protocol's discr