PAW Chain security record

Base audit version: In the contracts `PAWFlexibleStaking` and `PawLPStaking`(in the file `PAWSWAP Shibaswap LP Stake` and `PAWSWAP Uniswap LP Stake`), the role `Operator` has authority over the following functions: - function ChangeMultiplier(): change the value of `APY` and `RewardMultiplier` which affect the reward rate. - function ChangeOperator(): transfer the role `ChangeOperator` to another address. - function RemoveRewardPool(): transfer all the `wPAW` tokens of the current contract to the `Operator` address. - function PauseRewards()/UnpauseRewards(): set the `RewardsPaused` flag to true/false. - function ChangePairAddress(): change the `PairContract` address. In the contract `PAWLockedStaking`, the role `_owner` has authority over the following functions: - function renounceOwnership(): transfer the role `_owner` to address(0). - function transferOwnership(): transfer the role `_owner` to another address. - function stopReward(): set the value of `APY` to 0. - function startReward(): start the reward by changing the `poolInfo[0].lastRewardTimestamp` from `21616747` to `block.timestamp`. - function massUpdatePools(): update reward variables for all pools. - function RemoveRewardPool(): transfer the `rewardToken` tokens of the current contract to the `_owner` address. - function updateApy(): set the value of `APY`. - function updateExitPenalty(): set the value of `exitPenaltyPerc`. Update version [76547e0](https://github.com/Pawkishi/PAWSWAPtoken/commit/76547e0445bacfc912f928ce7c3eac9cb4f4e4cc): In the contracts `PawFlexibleStake`, `PawSushiLPStake`, and `PawUniLPStake`, the role `owner` has authority over the following functions: - function renounceOwnership(): transfer the role `_owner` to address(0). - function transferOwnership(): transfer the role `_owner` to another address. - function emergencyRewardWithdraw(): transfer all the reward tokens `wPAWToken` in the current contract to the `owner` address. - function recoverToken(): transfer all the token assets except `PAWToken` and `wPAWToken` to the `owner` address. - function updateNewAPY()/updateRewardPerTimeStamp(): set the value of `APY`/`rewardPerTimeStamp`. - function setWPAWStakingContract(): change the address `WPAWStaking`. The function `emergencyWithdraw()` will call the function `IwPAWFlexibleStaking(WPAWStaking).forceWithdraw()` if the `user.amount` is 0. In the contract `PawLockedStake`, the role `_owner` has authority over the following functions: - function renounceOwnership(): transfer the role `_owner` to address(0). - function transferOwnership(): transfer the role `_owner` to another address. - function withdrawPenalty(): transfer the early withdrawal penalty tokens to the `_owner` address. - function emergencyRewardWithdraw(): transfer all the reward token `wPAWToken` in the current contract to the `owner` address. - function recoverToken(): transfer all the token assets except `PAWToken` and `wPAWToken` to the `owner` address. - function updateEarlyWithdrawPenalty(): set the value of `earlyWithdrawPenalty` not greater than 30%. - function updateLockingDuration(): set the value of `lockDuration`. - function updateNewAPY(): set the value of `APY`. - function setWPAWStakingContract(): change the address `WPAWStaking`. The function `emergencyWithdraw()` will call the function `IwPAWFlexibleStaking(WPAWStaking).forceWithdraw()` if the `user.amount` is 0. Any compromise to the privileged accounts may allow the hacker to take advantage of this authority.

All PAW tokens are sent to the deployer address when deploying the contract. This could be a centralization risk as the deployer can distribute PAW tokens without obtaining the consensus of the community.

In the linked contracts, the reward token is the `wPAW` token. The token address is `0x083Af0FB9A8982E09e43AC718aeA9773E28c7f06`, but the actual implementation is unknown. In the function `Claim()` which the users used to retrieve the reward tokens, the `wPAW` token is transferred to the retriever from the current contract. However, we do not find the code which mints or transfers the `wPAW` token to the current contract.

Literals with many digits are difficult to read and review. For example: ```solidity=41 require(amount >= 100000000000, "The minimum deposit for staking is 0.0000001 LP"); ``` --- ```solidity=149 Unclaimed = (((RewardMultiplier * Time) * CalculatePAWequivalent(Deposits[user])) / 1000000000000000); ``` --- ```solidity=155 return (((ERC20(PAW).balanceOf(PairContract)*((((1000000000000000000 * amount) / (ERC20(PairContract).totalSupply())))) / 1000000000000000000))*2); ```

The contracts have an unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to ambiguity when debugging, as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

The linked variables `PAW`, `wPAW`, `lockDuration` assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.