Submitted by Trust, also found by 0xhacksmithh, 0xSmartContract, 9svR6w, deliriusz, Josiah, ladboy233, and zaskoh
Exchange.sol#L639
Exchange.sol#L30
In Non-Fungibles security model, users approve their ERC20 / ERC721 / ERC1155 tokens to the ExecutionDelegate contract, which accepts transfer requests from Exchange. 
The requests are made here:
The issue is that there is a significant centralization risk trusting Exchange.sol contract to behave well, because it is an immediately upgradeable ERC1967Proxy. All it takes for a malicious owner or hacked owner to upgrade to the following contract:
At this point hacker or owner can steal all the assets approved to Non-Fungible. 
Hacked owner or malicious owner can immediately steal all assets on the platform.
Exchange contract proxy should implement a timelock, to give users enough time to withdraw their approvals before some malicious action becomes possible.
The status quo regarding significant centralization vectors has always been to award Medium severity, in order to warn users of the protocol of this category of risks. See here for list of centralization issues previously judged.
berndartmuller (judge) commented:
nonfungible47 (Blur) acknowledged
