The state variable strategicPartner2TokensVested is declared but never written to or read within the contract logic. Similarly, the event StrategicPartner2TokensVested is defined but never emitted. The vesting logic for Strategic Partner 2 uses the generic vestingSchedules mapping, rendering these specific definitions redundant. This increases the contract size and deployment gas costs without providing any functionality.

The function setCommunityIncentivesController allows the Default Admin to update the communityIncentivesController address but fails to emit an event upon successful execution. Changing a privilege-holding address is a critical state change that should be observable by off-chain monitoring tools and users for transparency. Without an event, this change occurs "silently," making it difficult to track governance history or detect unauthorized updates.

The emitTreasuryFunds function uses lastTreasuryEmissionTime = block.timestamp to reset the vesting timer after each withdrawal. This implementation causes "time drift" because it effectively discards the time gap between when the funds became available and when the transaction was actually mined. If the administrator calls the function irregularly (e.g., days or weeks after the tokens unlocked), the emission schedule permanently shifts forward. Over the 5-year period, these accumulated delays mean the full distribution will take significantly longer than intended, deviating from the project's whitepaper or tokenomics schedule.

The implementation contract (the logic contract behind the proxy) lacks a constructor with the _disableInitializers() call. In OpenZeppelin upgradeable contracts, it is standard security practice to lock the implementation contract upon deployment to prevent it from being initialized directly. Without this lock, an attacker could theoretically call initialize() on the logic contract, claim ownership, and potentially confuse off-chain indexers or disrupt the contract state (though they cannot access proxy funds). We have verified on-chain that the deployer successfully initialized the implementation contract immediately after deployment. Since the initializer modifier prevents re-initialization, the window of vulnerability is effectively closed, and no further action is required for the current deployment.

The pause and unpause functions trigger the internal _pause() and _unpause() methods from OpenZeppelin's PausableUpgradeable library, which automatically emit standard Paused(address account) and Unpaused(address account) events. However, the contract also manually emits a custom TokensPaused(bool) event immediately after. This results in two events being emitted for the same action, increasing gas costs and cluttering the transaction logs without providing additional useful information.