Altrucoin security record

Boolean constants can be used directly and do not need to be compared to true or false.

The linked lines of code highlight an `else` block that has no implementation.

`public` functions which are never called internally within the contract should have `external` visibility.

There is a discrepancy between the following comments and lines of code: ```solidity=136 uint256 private MIN_LOCK_DURATION = 1 days; // 1 week uint256 private MIN_BONDING_LOCK_DURATION = 30 days; // 365 days ```

There are currently no checks ensuring the value of `MIN_LOCK_DURATION` is less than `MAX_LOCK_DURATION`.

Upon contract deployment, the deployer must manually pass the values for `tokenDecimal` and `dualTokenDecimal`, however, there are no checks to ensure the values are the correct decimal values for the correspondent IERC20 contract address.

The linked **require** statements are important for input validation and have been commented out. As these are values set by the deployer this finding is only informational.

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=90 IRewardDistributorV6 private rewardDistributor; //block based distributor contract ``` - The contract `StakingVaultV600` interacts with third party contract with `IRewardDistributorV6` interface via `rewardDistributor`. --- ```solidity=91 IFeeDistributorV6 private feeDistributor; //fee distribution contract ``` - The contract `StakingVaultV600` interacts with third party contract with `IFeeDistributorV6` interface via `feeDistributor`.

The external call to the `feeDistributor` contract attempts to utilize the `getFreeEntryExtiFeeUsers()`, however, in the current codebase there is a typo, and, as a result, the call will fail since that function does not exist.

```solidity=373 uint256 currentAmount; //will be existing locked balance + new tokens in tokens (not shares) ``` - Local variable `currentAmount` is never initialized. --- ```solidity=374 uint256 userCurrentLockedBalance; ``` - Local variable `userCurrentLockedBalance` is never initialized. --- ```solidity=1035 uint256 tokenHarvest; ``` - Local variable `tokenHarvest` is never initialized. --- ```solidity=1036 uint256 dualTokenHarvest; ``` - Local variable `dualTokenHarvest` is never initialized.