TRG

- If setsTrg() function is not called before the deposit() in the STRG starts, then it will lead to incorrect calculation of pendingRewards and dividendPerToken. By default the sTrg variable be a zero address.

The onlyOwner functions such as changeCult(), changeDCult(), changeTrg() and emergencyRemoveToken() can be exploited by a malicious admin resulting in a potential Denial of Service attack to users. For example, if the cult and the trg address is changed by a malicious admin to point to some other address, the users will not be able to call the bribe() function because it will lead to execution of the if statement on line: 163 resulting in Denial of Service attack. Additionally emergencyRemoveToken() can be used by a malicious admin to remove tokens that are unfavourable to the winning conditions and can be used to manipulate the game.

There are two contracts with similar names in the codebase, TheRugGame and THERUGGAME. It could be more convenient to have the names more explicit and less similar.

The staking in STRG contract has no time delay. As a result, there is no incentive for users to stake for a longer time once the rewards in TRG tokens are allocated by the admin to the STRG contract.

There is supply variable that has been used as a parameter in the constructor to mint a specific supply of tokens. But this does not guarantee that there won't be any more tokens minted apart from this supply which can be misleading.