Incorrect access control in TreasuryBTC::withdrawForStaking
The withdrawForStaking function uses both onlyOwner and a require(msg.sender == founder || msg.sender == owner()) check, making the founder check effectively unreachable when founder differs from owner.
Description
The function TreasuryBTC::withdrawForStaking has a conflicting access control design: it checks msg.sender == founder || msg.sender == owner(), but the onlyOwner modifier already restricts access to the owner. So, the founder can never call the function if they are not the owner.
function withdrawForStaking(uint256 amount) external onlyOwner {require(msg.sender == founder || msg.sender == owner(), "Only founder");// ...}
Recommendation
Remove the onlyOwner modifier.
Resolution
Nexalo: withdrawForStaking functionality has been completely removed.
Zealynx: If the founder was supposed to have withdrawal access independent of the owner, that's now lost.

