Vault.Inc

Certain contracts have special roles, which provide certain addresses with privileged roles. Such roles may pose a risk to end-users. The owner of the `TimeLockPool.sol` or `TimeLockNonTransferablePool.sol` contracts may perform the following privileged actions: 1. Give or revoke the role of `TOKEN_SAVER_ROLE` to any arbitrary address. 1. Call `saveToken()`, thereby transferring an arbitrary amount of an arbitrary token from the current contract to an arbitrary address. 1. Renounce ownership, by calling `renounceOwnership()`, thereby preventing the change of the currently set `TOKEN_SAVER_ROLE` role. 1. Transfer ownership (the role of `DEFAULT_ADMIN_ROLE`) to an arbitrary address. The owner of the `LiquidityMiningManager.sol` contract may perform the following privileged actions: 1. Give or revoke the role of `TOKEN_SAVER_ROLE` to any arbitrary address. 1. Call `saveToken()`, thereby transferring an arbitrary amount of an arbitrary token of the `LiquidityMiningManager.sol` contract to an arbitrary address. 1. Give or revoke the role of `GOV_ROLE` to any arbitrary address. 1. Add or remove pools, change pool weights or `rewardPerSecond`, by calling `addPool()`, `removePool()`, `adjustWeight()` and `setRewardPerSecond()` respectively. 1. Give or revoke the role of `REWARD_DISTRIBUTOR_ROLE` to any arbitrary address. 1. Distribute rewards by calling distributeRewards()`. 1. Renounce ownership, by calling `renounceOwnership(),` thereby preventing the change of the currently set `TOKEN_SAVER_ROLE`, `GOV_ROLE` and `REWARD_DISTRIBUTOR_ROLE` roles. 1. Transfer ownership (the role of `DEFAULT_ADMIN_ROLE`) to an arbitrary address. Note: As functions `addPool()`, `removePool()` and `adjustWeight()` call `distributeRewards()`, which is only callable by a reward distributor role holding account, it entails that the `GOV_ROLE` holding account will also hold the role of `REWARD_DISTRIBUTOR_ROLE`.

The constructor of `contracts\base\AbstractRewards.sol` utilizes code unknown (variables of function type) during the audit period to initialize the implementation of two functions, that are: `getSharesOf` and `getTotalShares`. This could cause the contracts to result in very different behavior from what was expected.