Hector Network (Audit 2)

In the contract Emissionor.sol the role `_owner` has authority over the following functions: - `setModerator()` - `setTreasury()` - `setSplitterContract()` - `setRewardToken()` Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and approve or unapproved moderators, or change the addresses of necessary variables. In the contract Emissionor.sol the modifier `onlyMod` has authority over the following functions: - `initialize()` - `emitReward()` Any compromise to the an approved `moderators` account may allow a hacker to take advantage of this authority and affect the reward emitting. In the contract LockAddressRegistry.sol the role `_owner` has authority over the following functions: - `initialize()` - `setAdmin()` - `setTokenVault()` - `setFNFT()` - `setEmissionor()` - `addFarm()` Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and set incorrect privileged contract addresses, potentially as EOA, or approve unintended addresses as farms. In the contract RewardWeight.sol the role `_owner` has authority over the following functions: - `register()` - `setRewardWeight()` - `updateReceiverStatus()` Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and set or change receive rate and/or status. In the contract SplitterDistributor.sol the role `_owner` has authority over the following functions: - `register()` - `setRewardContract()` - `updateReceiverStatus()` Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and change receiver status. In the contract TokenVault.sol the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and pause or unpause the functionality of the vault.  In the contract `RewardReceiver` the role `_owner` has authority over the following functions: - `setRewardToken()` Any compromise to the `_owner` account may allow a hacker to take advantage of this authority and improperly set the token received as rewards.

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user stakes 100 deflationary tokens (with a 10% transaction fee) in a MasterChef, only 90 tokens actually arrive in the contract. However, the user can still withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. Details on this kind of exploit: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f We notice that the current plan allows HEC, HEC/DAI, and HEC/USDC as the staking token, which is good for now. We want to ensure that the team does not plan to add any deflationary token(with transition fees) into the LockFarm pool.