To deploy a token contract, there must be a wallet address, am I right? Thus, must the coder be managing the wallet (with its private keys) that is used?
I'm looking at the scenario where what if someone outsourced the blockchain coding work to someone that is dishonest and that coder could run away with the tokens, if they know the private keys. Could they?
To deploy something, a transaction needs to be signed by a private key. The signing can be done by someone else than the developer, but it gets a bit complicated in my opinion.
As I see it, you have at least a few different options:
1) The developer only develops code and you do all the rest (deployment and so on). When code is ready, he gives that to you.
2) Developer deploys the ready product into a testnet where you can test it. Otherwise same as the first option.
3) Developer handles all deployments (also to mainnet) in which case he needs some private key (unless he sends you the bytecode, you sign a transaction of it and he continues with that, but that's a bit complicated approach). If wanted, developer can then assign whatever ownership status to accounts which your control.
I guess all of the options are used in real life and I can't tell you which ones are the most common / best.
In general, I would not give the developer the final ownership of the contracts in mainnet so he would only get paid after ownership has been transferred to you.
Short answer: no need to worry if you are the one signing the deployment transaction, you don't need developers for that.
Developers code and test with their wallets.
They give you the code and you deploy it with your wallet.
An easier way to do this, they can get the deployment code, ask you to sign it, they can deploy it themselves, but the transaction will have been sent by you. Be careful on what you sign though, they could give you a fake transaction.
This is very debatable, since it is highly dependent on the contract code. In your contract code you can create an owner only function, that only the wallet (basically a private key) can execute but that wouldn't fix your stolen private keys.
The other way is to implement a 2 out of 3 blessings system that requires that a minimum of 2 accounts out of 3 on ethereum to give their blessings in order to a particular function to be executed, and that can give you more power over the private keys pirate.
You can check DAO's Contracts and papers, they did implement many mechanisms to deal with this kind of situations.
In order to deploy a contract, you need a private key. There is a public address associated with this private key that must have ETH in it in order to deploy the contract.
Contracts can be written in such a way that either does or does not depend on the 'owner', or the person who created the contract. In the case of a token, it is not required that there be a specific owner, but the tokens must be distributed to the correct parties upon deployment.
You should never outsource work and provide a private key to your contractor. The best solution would be to have the person who is doing the work deliver to you a complete contract that you can simply deploy with your private key.
