EDUM security record

If the contract should not accept Ether, then the contract does not need to have a `receive()` function.

Inside the function `getLockedBalance()` the following condition will never be executed: ```solidity=231 if (lockStates[_addr].minReleaseTime == 0) { releaseTime += listingDate; } ``` This will never execute this if block due to `minReleaseTime` being set inside of `_releaseLockInfo()`, `_refactoringPreTimelock()`, or `_transferTimelock()`.

In the function `setControllers()`, the controllers are reset each call which can be inefficient if its not intended. It is inefficient due to having to remove all controllers one by one. For example: The protocol has 1 controller but wants to add a new one. When `setControllers()` is called again, the original controller has to be added in with the new one again otherwise the original controller will be removed.

One or more parameters with `memory` data location are never modified in their functions and those functions are never called internally within the contract. Thus, their data location can be changed to `calldata` to avoid the gas consumption copying from calldata to memory. ```solidity=108 function setControllers(address[] memory controllerList) public onlyOwner { ``` `setControllers` has memory location parameters: `controllerList`.

As some users will not have a timelock, it may be beneficial to check inside of `_releaseLockInfo()` if the length of `lockInfo` equals zero to avoid users using more gas than necessary.

The following functions have potentially confusing names: - `transferTimelock()` - `transferPreTimelock()` By calling these functions, it appears as the timeLock is already created.

In the contract `EDUM`, the following functions do not emit events: - `setControllers()`

The variable `listingDate`, `lockCount`, `totalLocked`, `totalAmount`, and `amountLength` are initialized with the value 0 . In Solidity, all un-initialized variables have a default value which for the uint256 variable is 0, hence the initialization part is redundant and can be removed.

The internal function `_transferTimelock()` does not need the `onlyController` modifier as the only functions that call it have the modifier as well.

Literals with many digits are difficult to read and review. The following variable should be revised: - `TOTAL_SUPPLY`