maxdao

The function `setDatetime()` and `setDatetime(uint256 _time)` can be called by anyone as it has no access restriction. This enables anyone to call this and change the `_timedate`

In the function `withdrawToken()`, a certain amount of tokens is supposed to be withdrawn per the `_order` detail. In L935, `_order.amount` will be sent to `msg.sender` in BEP20 contract in `_order.token`. However as the address in `_order.token` is defined in `_saveOrder()`, it could potentially point to a malicious contract, which could include logic that reentrant the MaxDAO contract.

Functions with names starting with `_` should be declared as `private`/`internal`.

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user transfers 100 deflationary tokens through `depositAlone()`, only 90 tokens actually arrived in the contract. However, the user can still take `100` as `_amount` value to calculate `currentValue`. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

The linked statements do not affect the functionality of the codebase and appear to be either leftovers from test code or older functionality.

The `upgrade()` function uses the magic number `210000e18`, while `_burnAmount()` function uses the magic number `30000e18` to calculate tokens that should be burnt

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.