Dtec - Audit 2

In the contract `PrivateSaleLock2` the role `_owner` has authority over the functions shown below. - pullTokens() - togglePause() Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - withdraw tokens from `PrivateSaleLock2` contract. - pause/unpause `PrivateSaleLock2` contract. --- In the contract `CommunityIncentives` the role `_owner` has authority over the functions shown below. - lockTokens() Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - lock a specified amount of tokens for vesting for a given user. --- In the contract `TgeVestingBase` the role `_owner` has authority over the functions shown below. - lockTokens() - lockTokensMultiple() Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and do the following: - lock a specified amount of tokens for vesting for a given user. - lock specified amounts of tokens for vesting for given users.

The `releaseFunds()` function permits users who purchased tokens during the `DTECPrivateSale` to claim a greater number of tokens that are released immediately. Nonetheless, should the rate related to immediate release be altered subsequent to the token purchase, the quantity of extra tokens claimable by users in `PrivateSaleLock2` may not correspond to the amount initially received at the time of purchase in `DTECPrivateSale`. Consequently, users could end up with a lesser or greater number of tokens than expected.

The `PrivateSaleLock2` contract is designed to distribute `dtecToken` to users. The `releaseFunds()` function is responsible for sending a specified proportion of tokens to users. The remaining unclaimed tokens are recorded in a state variable named `totalLockedSoFar`. Furthermore, the contract's owner has the ability to withdraw `dtecToken` from the contract, taking care to leave behind the amount specified in `totalLockedSoFar` to ensure that users' shares are not withdrawn. It's important to note that the value of `totalLockedSoFar` is variable, as it is contingent upon the number of users who have claimed their rewards via `releaseFunds()` so far.