Vault.Inc security record

There are no tests, and as such, the test coverage is 0%.

An event should always be emitted when a state change is performed in order to facilitate smart contract monitoring by other systems which want to integrate with the smart contract. This is not the case for the functions: 1. `AbstractRewards._correctPointsForTransfer()` does not emit any event upon a successful change of the state variables `pointsCorrection[_from]` and `pointsCorrection[_to]`. 1. `AbstractRewards._correctPoints()` does not emit any event upon a successful change of the state variable `pointsCorrection[_account]`.

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. The following functions do not have a proper validation of input parameters: 1. `AbstractRewards._prepareCollect()` does not check that parameter `_account` is different from `address(0)`. 2. `AbstractRewards._correctPointsForTransfer()` does not check that parameters `_from` and `_to` are different from `address(0)` or `_shares` is non-zero. 3. `AbstractRewards._correctPoints()` does not check that parameter `_account` is different from `address(0)` or `_shares` is non-zero. 4. `TimeLockPool.deposit()` does not check that parameter `_receiver` is different from `address(0)`. 5. `TimeLockPool.withdraw()` does not check that parameter `_receiver` is different from `address(0)`.

The following functions do not follow the `Checks-Effects-Interactions` pattern, as they perform calls to external contracts before changing state variables, while at the same time not being protected through i.e. a `nonReentrant` modifier: - `TimeLockPool.deposit()` - `BasePool.distributeRewards()` Note that a re-entrancy would be also possible for seemingly benign `rewardToken` or `depositToken` tokens, in case those are based on the ERC777 standard, allowing to hook transfers [and divert control flow](https://medium.com/cream-finance/c-r-e-a-m-finance-post-mortem-amp-exploit-6ceb20a630c5).

In `AbstractRewards._correctPoints()` the insecure primitive casting operation `int256()` is used. For sufficiently large positive or negative values this cast may wrap around, without leading to a revert and therefore lead to unexpected behaviour.