Pension Token

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - transfer ownership through `transferOwnership()` - permanently renounce ownership through `renounceOwnership()`  In the contract `PensionProtocolToken` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - set `liquidityAddress`, `marketingAddress` and `developmentAddress` through `setFeeReceivers()` - set the fees up to fifteen in total through `setFees()` - exempt or include an address from/in fees through `setFeeExempt()` - transfer tokens on this contract to any address through `rescueToken()` - transfer ether on this contract to any address through `clearStruckBalance()` - set the next timestamp for rebasing through `setNextRebase()` - add or remove automated market maker pair through `setAutomatedMarketMakerPair()` - set the rebasing time delay up to eighteen hundred seconds through `setRebaseFrequency()` - set the reward rate and denominator through `setRewardYield()`  In the contract `PensionProtocolToken` the role `_owner` has authority over the functions shown below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - add liquidity through `swapBack()` - mint uncapped "gon" tokens on any account through `mint()` - burn from any account through `burn()` - rebase the supply of the token through `manualRebase()` In the contract `TokenHandler` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - take all tokens on this contract through `sendTokenToOwner()`  In the contract `WhitelistedRole` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - add an account to the whitelist through `addWhitelisted()` - remove an account from the whitelist through `removeWhitelisted()` 

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - transfer ownership through `transferOwnership()` - permanently renounce ownership through `renounceOwnership()`  In the contract `PensionBank` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - set the pension token address through `setPensionToken()` - update the pension tax up to eighty percent through `updatePensionTax()`  In the contract `PensionBank` the role `_whitelisted` has authority over the functions shown below. Any compromise to the `_whitelisted` account may allow the hacker to take advantage of this authority and - rebase the pension token and take dividends through `rebase()` In the contract `WhitelistedRole` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and - add an account to the whitelist through `addWhitelisted()` - remove an account from the whitelist through `removeWhitelisted()` 

Tokens are sent to the deployer when deploying the contract. This could be a centralization risk as the deployer can distribute tokens without obtaining the consensus of the community.

Balance is not added to `liquidityBalance` which will always be zero.

The calculated `supplyDelta` would always be non-negative given that `rewardYield` and `circulatingSupply` are non-negative. Yet the rebasing logic assume that it could be negative.

The mentioned functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility.

The function that affects the status of sensitive variables should be able to emit events as notifications to users.

The given input is missing the check for the non-zero address.

The aforementioned code is not used and seems redundant.

The `_transferFrom` method restricts token transfer to only `excludedAccount`. While listed `automatedMarketMakerPairs` are allowed to send but not allowed to receive pension tokens, this means the user cannot freely sell or transfer their pension tokens. To sell they would have to call `sell()` in the `PensionBank` contract, yet it would incur a high 50% of pension tax.