Upgrade Permission for the Protocol Assigned to the Project Owner

In the protocol, there are two roles:

• The MDCreate2 contract controlled by TokenTable, which is responsible for initialising the contracts inheriting from BaseMerkleDistributor and includes the fee parameters required for token distribution.
• The contract owner, which is controlled by the project team responsible for the token distribution.

However, the upgrade privilege is assigned to the contract owner, which can lead to potential issues.

// solhint-disable-next-line no-empty-blocks
function _authorizeUpgrade(address newImplementation) internal virtual override onlyOwner { }

It gives the project owner control to upgrade the distribution contracts.

The project team can upgrade the contract and set the deployer address to a malicious implementation they control. This allows them to bypass paying fees to TokenTable or even take the fees for themselves.

Removal of the upgradability option.

TokenTable: Fixed in c991b09f8da9eba24b0a789e6c7cb332d0394f40.