EdgeMatrix Computing Protocol 2(EMC 2)

In the contract `MerkleClaim` the role `_owner` has authority over the functions shown in the diagram below.  Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - replace `merkleRoot` and generate new `merkleProofs` to claim the tokens in the contract. In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below.  Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - transfer ownership to zero address. - transfer ownership to a specific address. --- In the contract `NodeStakeV1` the role `manager` has authority over the functions shown in the diagram below.  Any compromise to the `manager` account may allow the hacker to take advantage of this authority and do the following: - set upper and lower deposit limits. - turn on or turn off the deposit function. - update `manager` address.

The project design may not be compatible with non-standard ERC20 tokens, such as deflationary tokens or rebase tokens.

The change of `_owner` by function `transferOwnership()` overrides the previously set `_owner` with the new one without guaranteeing the new `_owner` is able to actuate transactions on-chain.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=461 address public immutable override token; ``` - The contract `MerkleClaim` interacts with third party contract with `IERC20` interface via `token`. --- ```solidity=39 IERC20 public immutable token; //Token's contract address for reward. Will be designated as EMC token (has been audited) contract address ``` - The contract `NodeStakeV1` interacts with third party contract with `IERC20` interface via `token`.

As a general practice, use of `abi.encodePacked` isn't recommended, since it is susceptible to hash collisions in some instances where dynamically-sized inputs are used consecutively. While this is not the case in this instance, we also note that `abi.encodePacked` may be removed in future solidity versions (see this issue: [https://github.com/ethereum/solidity/issues/11593](https://github.com/ethereum/solidity/issues/11593)).