Since the smart contract doesn’t have a private key, once transferred tokens to the contract address, they may never be returned. In addition, Some contracts have reserved codes that can transfer Tokens, and some people believe that this is a hidden danger left by anonymous project parties.