I couldn't understand if this tendermint protocol is proof-of-stake or something like proof-of-lock?
Yes, it looks like Proof-of-Stake or at least something very similar, and suffers from similar issues, for example:
Note that this does not preclude a 2/3 majority of validators from publishing a blockchain fork after they had unbonded and sold their coins to an unsuspecting party. This is called a long-range double-spend attack. A user can avoid long-range attacks by syncing their blockchain periodically within the bounds of the unbonding period.