Meta Demos security record

In the contract `Coin`, the role `MANAGER_ROLE` has authority over the following function(s): - function `revokeVested()`, `revokeVestedAll()` and `revokeVestedAllBatch()`, to revoke vesting. - function `distribute()` and `distributeVested()`, to distribute the token in normal or vested way. - function `setExcludedFee()`, `setForcedFee()` and `setFees()`, to manage the fee rules. - function `withdrawFee()`, to withdraw the fee from the contract. - function `togglePause()`, to pause or unpause the contract. The role `DEFAULT_ADMIN_ROLE` has authority over the following function(s): - function `_authorizeUpgrade()`, to change the proxy contract. Any compromise to the privileged accounts may allow a hacker to take advantage of this authority and bring unpredictable damages to the project.

The mentioned contracts are upgradeable contracts, the owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract.

Accessing storage variables in a loop can be costly in terms of gas consumption. ```solidity=291 _reservedAmount += fee; ```

The checking `nonTransferable == 0 || transferable >= amount + nonTransferable` can be simplified. Logically, checking if `nonTransferable == 0` makes no sense, as the function does not have special strategy for the condition. All that should be checked is `transferable >= amount + nonTransferable`. And it is more demanding than the outer checking `fromBalance >= amount`.