Dtec - Audit 2

The `PrivateSaleLock2` contract is designed with two primary methods, `releaseFunds()` and `claim()`, to facilitate users in claiming tokens. Specifically, the `releaseFunds()` method reads the quantity of tokens purchased by the user from the `DTECPrivateSale` contract and directly releases a certain amount of tokens to the user based on the `immediateReleaseRate` set in the `DTECPrivateSale` contract. The `claim()` method calculates the total amount of tokens released to the current user through the `PrivateSaleLock` contract, subtracts the amount already claimed by the user, and transfers the currently claimable tokens to the user. The underlying design intent here is that the total number of tokens released through `releaseFunds()`, combined with the total released through the `claim()` method, equals the number of tokens purchased by the user via the `DTECPrivateSale` contract. Additionally, since users can obtain their purchased tokens through both the original `DTECPrivateSale` contract and the `PrivateSaleLock` contract, and can also receive the same amount of tokens through the `PrivateSaleLock2` contract, they ultimately have the opportunity to receive double the amount of tokens.

The associated variables have been given fixed values through hard coding, which cannot be modified. Additionally, the token decimal appears to be hardcoded to 18.

The `lockStartTime` state variable in the `CommunityIncentives` and `TgeVestingBase` contracts signifies the commencement time for the release of the vested amount. It is designated as immutable, indicating that its value is assigned only once. For the vesting service to operate accurately, `lockStartTime` must not be initialized to zero. Consequently, evaluating whether `lockStartTime` equals zero is redundant. ```solidity if (info.totalClaimed == info.totalAmount || lockStartTime == 0 || block.timestamp < lockStartTime) { return 0; } ``` ```solidity if (info.totalClaimed == info.totalAmount || lockStartTime == 0 ) { return 0; } ```

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity DTECPrivateSale public constant privSale1 = DTECPrivateSale(0x6d158bb60FfF3a66F0290BF3F156B9d355163e50); PrivateSaleLock public constant privSale1Lock = PrivateSaleLock(0x47D5c7599991F121A817C289B8E62Dd2015D5Eb3); IERC20 public constant dtecToken = IERC20(0xd87aF7B418d64FF2cdE48d890285bA64fc6E115F); ``` ```solidity address public immutable dtecTokenAddress; ```

The linked statements do not affect the functionality of the codebase and appear to be either remnants of test code or older functionality.