CleanCarbon.io security record

There are `86_400` seconds in a day, so there are `86_400*30 = 2_592_000` seconds per month (assuming the convention that a month always counts as 30 days). However, the constant `secondPerMonth` is set to `259_200`, which is the amount of seconds per 3 days. This will cause the amount that is to be rewarded each month for the team developers to be rewarded every 3 days.

In the contract `stakingCarbon`, users stake `mainToken` in the contract. The `emergencyWithdraw()` function allows the `DEFAULT_ADMIN_ROLE` to withdraw any ERC20 token from the contract, including the staked `mainToken` of users.

The `ADMIN` role is only used in the `AirdropCarbonv2` contract to restrict `changeAdminRole`. Since the contract does not use the `ADMIN` role to restrict access to any functions not directly related to the role itself, it can be removed.

The `ADMIN` calls `addStakingPayload()`, to add additional staking options. This function would not be called unless the new staking option was intended to be active, as there is no functionality to change if a specific staking option is active. Thus, the `payload` does not need a parameter for `isActive` as it should always be true.

The contracts `StakingCarbon` and `CarboTokenv2` have `payable` constructors allowing native tokens to accidentaly be sent when deploying the contract that will be locked in the contract.

There should always be events emitted in the sensitive functions that are controlled by centralization roles. The functions linked above do not emit events.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=26 carboV1Addr = _tokenV1; ``` - `_tokenV1` is not zero-checked before being used. --- ```solidity=27 carboV2Addr = _tokenV2; ``` - `_tokenV2` is not zero-checked before being used. --- ```solidity=46 mainToken = _mainToken; ``` - `_mainToken` is not zero-checked before being used.

Suffixes like seconds, minutes, hours, days and weeks after literal numbers can be used to specify units of time where seconds are the base unit and units are considered naively in the following way: - 1 == 1 seconds; - 1 minutes == 60 seconds; - 1 hours == 60 minutes; - 1 days == 24 hours; - 1 weeks == 7 days;

In the contract `CarboTokenv2`: - The comment below `secondsPerMonth` is unnecessary and can be deleted. - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted. In the contract `AirdropCarbonv2`: - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted. In the contract `StakingCarbon`: - The comment in the function `emergencyWithdraw()` is unnecessary and can be deleted.

The `emergencyWithdraw()` interacts with any possible ERC20 tokens. Since some ERC20 tokens return no values and others return a `bool` value, they should be handled with care.