dHEDGE - Ⅳ

In the contract `DhedgeStakingV2Storage` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and change `maxVDurationTimeSeconds`, `dhtCap`, `rewardStreamingTime`, `tokenUriGenerator` and several attributes of RewardParams struct such as: `stakeDurationDelaySeconds`, `maxDurationBoostSeconds`, `maxPerformanceBoostNumerator`, `stakingRatio` and `emissionsRate`. Furthermore he can gain the ability to configure new pools. 

Since `DhedgeStakingV2Storage` and `DhedgeStakingV2` are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

Since the implementation of `IPoolLogic.tokenPrice()` is unknown, it is not possible to rely on the value returned by that function. There is the possibility of price manipulations by attackers and thus all the operations involving this function call may be affected. For example: - An attacker manipulates the token price by lowering it considerably. - In `unstakePoolTokens()` the manipulated value is assigned to `tokenPriceFinish`. For example, consider a value lower than `stake.stakeStartTokenPrice`. - `stake.reward` is assigned the amount computed by `calculateDhtRewardAmount()`, which under these assumptions can always be forced to zero. This occurs if inside `calculateDhtRewardAmount()` the computed value of `performanceMultiplier` is zero, which happens when `tokenPriceFinish` is less than or equal to `tokenPriceStart`.