Aderlo Metaverse

`ACC.sol`, `ACCTokenSale.sol` and `VestingWallet.sol` are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

Since ACC tokens are transferred out from this contract when `buyTokens()` or `sendOutsidePurchase()` are executed, its ACC balance will decrease over time. Instead, the value of `totalTokensPurchased` will only increase over time. At a certain point, if no other ACC tokens are sent to the contract, the require statements at lines 50 and 128 will always revert and the contract will be in stuck.

The magic number 80 is used in the code instead of the state variable `vestedPercentage`.

One or more declarations do not conform to the [Solidity style guide](https://solidity.readthedocs.io/en/v0.7.3/style-guide.html#naming-conventions) with regards to its naming convention. Particularly: - `camelCase`: Should be applied to function names, argument names, local and state variable names, modifiers - `UPPER_CASE`: Should be applied to `constant` variables - `CapWords`: Should be applied to contract names, struct names, event names and enums ```solidity=11 uint256 public constant tokensPerEth = 10000; ``` - Constant variable `tokensPerEth` is not in `UPPER_CASE`. --- ```solidity=14 uint256 public constant vestedPercentage = 80; ``` - Constant variable `vestedPercentage` is not in `UPPER_CASE`. --- ```solidity=15 uint256 public constant vestingPeriod = 30 days * 12; ``` - Constant variable `vestingPeriod` is not in `UPPER_CASE`.

The error messages at linked lines are not understandable by users.

The following checks are missing: - In `AderloNFT.sol` the `tokenId` passed to `burn()` should be greater than zero since the minting process starts from index 1 due to the increment made at line 16. - In `ACCTokenSale.sol` the `tokenAddress` passed to the `initialize()` function is not zero-checked. - In `ACCTokenSale.sol` `aderlo`, `planetary` and `marketing` addresses passed to `withdraw()` are not zero-checked. - In `ACCTokenSale.sol` the `msg.value` used when calling `buyTokens()` must be greater than zero. - In `ACCTokenSale.sol` the `amount` parameter passed to `sendOutsidePurchase()` must be greater than zero.

In the function `withdraw()`, which is controlled by a centralization role, no event is emitted.

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

In `sendOutsidePurchase()` if `amount` passed as input is greater than `[(2**256 - 1) - totalTokensPurchased]`, an overflow condition may happen at line 125.

In `withdraw()` the magic numbers 10 and 45 are used at lines 98 and 99.