Max allocations can be bypassed with multiple addresses because of guaranteed allocations
`TokenSale._processPrivate()` ensures that a user cannot deposit more than their allocation amount. However, each address can deposit up to at least `maxAllocations`. This can be leveraged by a malicious user by using different addresses to claim all tokens without even staking.\\nThe idea of the protocol is to give everyone the right to have at least `maxAlocations` allocations. By completing missions, users level up and unlock new tiers. This process will be increasing their allocations. The problem is that when a user has no allocations, they have still a granted amount of `maxAllocations`.\\n`TokenSale.calculateMaxAllocation` returns $max(maxTierAlloc(), maxAllocation)$\\nFor a user with no allocations, `_maxTierAlloc()` will return 0. The final result will be that this user have `maxAllocation` allocations (because `maxAllocation` > 0).\\n```\\n        if (userTier == 0 && giftedTierAllc == 0) {\\n            return 0;\\n        }\\n```\\n\\nMultiple Ethereum accounts can be used by the same party to take control over the IDO and all its allocations, on top of that without even staking.\\nNOTE: setting `maxAllocation = 0` is not a solution in this case because the protocol wants to still give some allocations to their users.
A possible solution may be to modify `calculateMaxAllocation` in the following way:\\n```\\n    function calculateMaxAllocation(address _sender) public returns (uint256) {\\n        uint256 userMaxAllc = _maxTierAllc(_sender);\\n// Add the line below\\n       if (userMaxAllc == 0) return 0;\\n\\n         if (userMaxAllc > maxAllocation) {\\n            return userMaxAllc;\\n        } else {\\n            return maxAllocation;\\n        }\\n    }\\n```\\n
Buying all allocations without staking. This also violates a key property that only ION holders can deposit.
```\\n        if (userTier == 0 && giftedTierAllc == 0) {\\n            return 0;\\n        }\\n```\\n