Delabs Adventure Pass Staking security record

There is no storage gap preserved in the logic contract. Any logic contract that acts as a base contract that needs to be inherited by other upgradeable children should have a reasonable size of storage gap preserved for the new state variable introduced by the future upgrades.

The `lock()` function allows adding a new `lockedPeriod` when the previous `lockedPeriod` has expired. However, the current implementation only replaces the old `lockedPeriod` with the new one while keeping the `startTime` unchanged, without taking into account the previous `lockedPeriod`. To correctly implement this feature, the new `lockedPeriod` should be added to the existing `stakingPosition`, that is, using the expression `stakingPosition.lockedPeriod += lockedPeriod` to replace the following implementations in the `_lock` function: ```solidity function _lock(address holder, uint256 tokenId, uint40 lockedPeriod) internal { ... stakingPosition.lockedPeriod = lockedPeriod; // convert to seconds ... } ```

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

The contract cited has an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler-specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.