PerionXP security record

The `TransparentUpgradeableProxy` is an upgradeable contract. The owner can upgrade the contract without the community's commitment. If an attacker compromises the account, he can change the implementation of the contract and drain tokens from the contract. In commit [16e14431228c2dfcf8fb180030f2b1159a952676](https://github.com/Periondao/perion-liquidity-mining/blob/16e14431228c2dfcf8fb180030f2b1159a952676/contracts/TimeLockPool.sol), the function `refund()` is added, which allows the admin role to refund a user's deposit ahead of time. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and withdraw tokens from the pool.

The current design is not compatible with **non-standard ERC20** tokens, such as deflationary tokens or tokens that adhere to the ERC777 standard. Implementing non-ERC20 compliant versions of the `depositToken` and `rewardToken` functions may result in unexpected behavior and potential security issues. ```solidity=31 IERC20 public depositToken; IERC20 public rewardToken; ```

The linked functions are equivalent to the compiler-generated getter functions for the respective variables. ```solidity function getDepositsOf(address _account) public view returns(Deposit[] memory) { return depositsOf[_account]; } ... function withdrawnRewardsOf(address _account) public view override returns (uint256) { return withdrawnRewards[_account]; } ``` It is a better practice to instead declare the variable as `public` as compiler-generated getter functions are less prone to error and more maintainable than manually written ones.