Lif3 - vaults - SC

In the contract `LockingRewardPool` the role `DEFAULT_ADMIN_ROLE` has authority over the functions shown in the diagram below, as well as the privilege to assign/revoke all roles. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily set the lower limit of deposit amount, and assign/revoke privileged roles.  In the contract `LockingRewardPool` the role `RECOVERER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `RECOVERER_ROLE` account may allow the hacker to take advantage of this authority and withdraw any token that's not involved in the lock and reward process.  In the contract `LockingRewardPool` the role `REWARD_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `REWARD_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and add and update the reward tokens and related reward rate. Notice that changing the reward token decimal will result in the reset of current reward distribution.  In the contract `LockingRewardPool` the role `TAX_ADMIN_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `TAX_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily set the fee rates and fee exemption. 

In the contract `LockNFT` the role `CREATOR_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `CREATOR_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily mint lock NFT.  In the contract `LockNFT` the role `DESTROYER_ROLE` has authority over the functions shown in the diagram below. Any compromise to the `DESTROYER_ROLE` account may allow the hacker to take advantage of this authority and arbitrarily burn lock NFT.  In addition, the role `DEFAULT_ADMIN_ROLE` has the authority to grant and renounce the `CREATOR_ROLE` and `DESTROYER_ROLE` roles, as provided by the inherited contract `AccessControl`. Any compromise to the `DESTROYER_ROLE` account may allow the hacker to take advantage of this authority and take over privileged role's management.