Zeebu security record

In function `_afterTokenTransfer()`, a hook `IERC20Receiver(to).onERC20Receive()` is set to notify the token recipient. The function lacks of logic and validation to check if the potential callback from `to` address is expected behavior.

```solidity=2104 try IERC20Receiver(to).onERC20Receive(from, amount) returns (bool success) { // the recipient returned a bool, TODO validate if they returned true } catch { // the notification failed (maybe they don't implement the `IERC20Receiver` interface?) } ``` - The variable `success` is never used after this assignment.

It is not recommended to use Solidity's `transfer()` and `send()` functions for transferring Ether, since some contracts may not be able to receive the funds. Those functions forward only a fixed amount of gas (2300 specifically) and the receiving contracts may run out of gas before finishing the transfer. Also, EVM instructions' gas costs may increase in the future. Thus, some contracts that can receive now may stop working in the future due to the gas limitation. ```solidity=2124 adminAddress.transfer(address(this).balance); ``` - `ERC20PresetMinterPauser.flush` uses `transfer()`.

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.