Tokemak

Upon addition (`_addSchedule`) of schedules the setup property is set to true. The require statements in the `slash` and `depositFor` functions seem to be useless.

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. The owner can pause contracts and perform privileged operations. For instance, the owner can withdraw the diff of already withdrawn and initially vested tokens to the treasury. Users can lose funds if the owner account gets compromised or they go rogue.

> A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker frontruns the victim trade by also buying asset Y, lets the victim execute the trade, and then backruns (executes after) the victim by trading back the amount gained in the first trade. Intuitively, one uses the knowledge that someone’s going to buy an asset, and that this trade will increase its price, to make a profit. The attacker’s plan is to buy this asset cheap, let the victim buy at an increased price, and then sell the received amount again at a higher price afterwards. In both stated contracts, `minAmountA` and `minAmountB` are provided in the `deploy` function. However, they are not checked after addLiquidity is called.

The `cycleDuration`, which is set in the `initialize` and `setCycleDuration` functions, can be set to an unsafe small value. Since miners can manipulate block numbers within a small range, the miners might be able to trigger the `completeRollover` earlier or later than the intended `cycleDuration`.

There is no possiblity to alter properties of a given schedule. It might be needed to set certain props, namely `isActive` and `isPublic`. Not being able to unset `isActive` seems to be a bigger issue. To stop deposits, the only possibilities would be **i)** to pause the contract (which would affects all schedules) or **ii)** remove the schedule of interest.

The `withdraw` function in the stated contracts, unlike the deposit function, is not pausable. The same holds true for the `slash` function in the staking contract.

The provided liquidity is not eligible for SUSHI rewards.

Both `deposit` and `withdraw` functions accept external addresses and trust them with calling transfer (safeTransfer) on them. Calling token methods on arbitrary addresses is a bad security practice. At the moment, only the manager can call these methods. Moreover, deposit does not check duplicates before adding tokens to the token list.

All the deposited tokens are approved with the maximum value to be pulled out by the `zeroExRouter` address.