The Dtec World security record

### DTECTokenSale.sol In the contract `DTECTokenSale` the role `_owner` has authority over the functions listed below. - addMods(): add addresses into `mods` role. - togglePause(): pause or unpause the buying tokens. - setStableAddresses(): set the `USDC` and `USDT`. - setImmediateReleaseRate(): set `immediateReleaseRate`. - setPaymentReceiver(): set `paymentReceiver`. - setSalePrice(): set `salePrice`. - pullTokens(): transfer `DTEC` to `_owner`. - transferOwnership(): transfer ownership to a new account. - renounceOwnership(): renounce the ownership of the contract. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, manage the configuration of the contract, and transfer `DTEC` to `_owner`. ### DTECPreSale.sol In the contract `DTECPreSale` the role `_owner` has authority over the functions listed below. - addMods(): add addresses into `mods` role. - togglePause(): pause or unpause the buying tokens. - setStableAddresses(): set the `USDC` and `USDT`. - setImmediateReleaseRate(): set `immediateReleaseRate`. - setPaymentReceiver(): set `paymentReceiver`. - setSalePrice(): set `salePrice`. - pullTokens(): transfer `DTEC` to `_owner`. - transferOwnership(): transfer ownership to a new account. - renounceOwnership(): renounce the ownership of the contract. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, manage the configuration of the contract, and transfer `DTEC` to `_owner`. ### DTECPrivateSale.sol In the contract `DTECPrivateSale` the role `_owner` has authority over the functions listed below. - addMods(): add addresses into `mods` role. - togglePause(): pause or unpause the buying tokens. - setStableAddresses(): set the `USDC` and `USDT`. - setImmediateReleaseRate(): set `immediateReleaseRate`. - setPaymentReceiver(): set `paymentReceiver`. - setSalePrice(): set `salePrice`. - pullTokens(): transfer `DTEC` to `_owner`. - transferOwnership(): transfer ownership to a new account. - renounceOwnership(): renounce the ownership of the contract. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, manage the configuration of the contract, and transfer `DTEC` to `_owner`. In the contract `DTECPrivateSale` the role `mods` has authority over the functions listed below. - addWLs(): add addresses into private sale whitelist. Any compromise to the `mods` account may allow the hacker to take advantage of this authority, manage the configuration of the contract. ### DTECPublicSale.sol In the contract `DTECPublicSale` the role `_owner` has authority over the functions listed below. - addMods(): add addresses into `mods` role. - togglePause(): pause or unpause the buying tokens. - setStableAddresses(): set the `USDC` and `USDT`. - setImmediateReleaseRate(): set `immediateReleaseRate`. - setPaymentReceiver(): set `paymentReceiver`. - setSalePrice(): set `salePrice`. - pullTokens(): transfer `DTEC` to `_owner`. - transferOwnership(): transfer ownership to a new account. - renounceOwnership(): renounce the ownership of the contract. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority, manage the configuration of the contract, and transfer `DTEC` to `_owner`. ### LinearLock.sol In the contract `LinearLock` the role `_owner` has authority over the functions listed below. - setReleaseInfo(): set `lockStartTime` and `releaseRate`. - setTokenLocker(): set `tokenLocker`. - setPeriod(): set `period`. - transferOwnership(): transfer ownership to a new account. - renounceOwnership(): renounce the ownership of the contract. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and manage the configuration of the contract. In the contract `LinearLock` the role `tokenLocker` has authority over the functions listed below. - lockTokens(): increase locked amount of `_user`. Any compromise to the `tokenLocker` account may allow the hacker to take advantage of this authority and manage the data of the contract. ### PreSaleLock.sol In the contract `PreSaleLock` the role `_owner` has authority over the functions listed below. - setReleaseInfo(): set `lockStartTime` and `releaseRate`. - setTokenLocker(): set `tokenLocker`. - setPeriod(): set `period`. - transferOwnership(): transfer ownership to a new account. - renounceOwnership(): renounce the ownership of the contract. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and manage the configuration of the contract. In the contract `PreSaleLock` the role `tokenLocker` has authority over the functions listed below. - lockTokens(): increase locked amount of `_user`. Any compromise to the `tokenLocker` account may allow the hacker to take advantage of this authority and manage the data of the contract. ### PrivateSaleLock.sol In the contract `PrivateSaleLock` the role `_owner` has authority over the functions list

All of the `DTEC` tokens are sent to the contract deployer or one or several externally-owned account (EOA) addresses. This is a centralization risk because the deployer or the owner(s) of the EOAs can distribute tokens without obtaining the consensus of the community. Any compromise to these addresses may allow a hacker to steal and sell tokens on the market, resulting in severe damage to the project.

In the contract `DTECTokenSale`, the function `transferFundsAndCalculateReleaseAmounts()` uses the identical `salePrice` for `USDC` and `USDT` tokens. This assumes these two tokens have the same value and decimal.

In the lock contracts, it is noted that the corresponding contract uses unified variable `lockStartTime` to calculate the claimable `DTEC` amount for all users. As a result, after a certain and long period and the `lockStartTime` is not updated by `_owner` in time, users can immediately claim the purchased tokens after buying, and lock contracts may not work well as intended.

The `USDC` and `USDT` are hardcoded in the codebase.