EML security record

The following is the calculation for the remaining locked vesting amounts in function `getVestingLockedAmount()`. ```solidity=376 vestingLockedAmount += (amount * ((expiresAt - timestamp) / period)) / count; ``` Due to the truncation, vesting locked amounts will unlock earlier than expected, leading to discrepancies between the amount that should be locked and the amounts that are actually locked in the implementation.

In functions `_addVestingLock()` and `_updateVestingLock()` there is no checking for the input parameter `startsAt` when creating or updating a vesting lock entry. The original checking has been commented out in both functions. ```solidity // require(startsAt > block.timestamp, "VestingLock: must set after now"); ``` This could lead to cases where the `_locker` role can effectively unlock transactions that have vesting locks by setting a `startsAt` date far enough into the past that it leads to the expiration of the vesting lock.

It is noted that although transfers of the internal ERC-20 token is not allowed while the token contract is paused due to checks implemented in the `_beforeTokenTransfer()` function, transfers of other tokens within the token contract are still allowed. ```solidity function _beforeTokenTransfer( address from, address to, uint256 amount ) internal override(ERC20Upgradeable) { require(!isFreezed(from), "Freezable: token transfer from freezed account"); require(!isFreezed(to), "Freezable: token transfer to freezed account"); require(!isFreezed(_msgSender()), "Freezable: token transfer called from freezed account"); require(!paused(), "Pausable: token transfer while paused"); // Note: This restricts the internal ERC-20 token from being transferred while the contract is paused ``` Transfer of tokens other than the internal ERC-20 token can be executed using the `recoverToken()` function by the owner. ```solidity=424 function recoverToken(address tokenAddress, uint256 tokenAmount) public onlyOwner { IERC20Upgradeable(tokenAddress).transfer(owner(), tokenAmount); } ``` The audit team would like to check to see if this aligns with the intended design since the transfer of other tokens within the contract will still be possible when the contract is paused.