EGC Staking - Audit

In the `EverGrowStaking.sol` contract, - the role `_owner` has authority over the following functions: - function `addAdmin()`, to add an admin. - function `removeAdmin()`, to remove an admin. - function `setMaxStakingPerBatch()`, to set the max staking amount per batch. - function `setSmallFeeToBoostTotalExcluded()`, to set the small fee amount of distribution. - function `setSlippage()`, to set the slippage tolerance of swapping tokens when compounding rewards. - function `setExitFee()`, to set the exit fee percentage. - function `setEntryFee()`, to set the entry fee percentage. - function `setFeeRecipient()`, to set the fee recipient address. - function `setDEX()`, to set the DEX address. - function `setSwapPath()`, to set swap paths. - function `setStartIndex()`, to set the start index for package looping. - function `setPause()`, to pause the contact, staking, unstaking, claiming rewards, and compounding rewards. - the role `admin` has authority over the following functions: - function `setSafeMode()`, to change the safe mode. - function `addPackage()`, to create a package, transfer the rewards token to the contract, and set the number per second of token distribution. - function `alterPackage()`, to update the package attributes. - function `endPackage()`, to end the package. - function `claimAllRewardsForUser()`, to claim all rewards for the user. - function `claimAllRewardsForUsers()`, to claim all rewards for the users. In the `Ownable` contract, the `owner` role has authority over the following function: - function `changeOwner`, to change the owner. Any compromise of the privileged accounts could potentially enable a hacker to exploit their authority, allowing them to change the fee address, update the fee rate to collect fees, end reward packages to reclaim reward tokens, and ultimately disrupt the project's normal functionalities. **The `alterPackage` function is exclusively controlled by the `admin` role, which is responsible for updating crucial state variables like `totalToDistribute`, and `timePeriod`. These variables are pivotal to the project's integrity and impact the number per second of the token distribution and the total distribution of reward tokens. Unauthorized modifications could severely impact certain functionalities, potentially eroding user trust.**

The lack of restrictions on the `stake` function permits users to stake their tokens even after all packages have concluded. As a result, users may face losses since there are no rewards to distribute, and entry and exit fees will be charged when staking or unstaking their tokens. We would like to confirm with the team whether this is aligned with original design.