Police also believe that key evidence -- including security footage that would have documented the early Sunday blaze in the southern college town of Santa Maria -- has been hidden from investigators.
Investigators are under pressure to solve the case as Brazil, host of the 2014 World Cup and the 2016 Olympic Games in Rio de Janeiro, is attempting to prove that they can safely host large public events.
Police on Monday arrested the two owners of the Kiss nightclub, and two musicians who allegedly took part in the ill-fated pyrotechnic show.
Santa Maria police chief Marcelo Arigony told reporters Tuesday that the musicians bought a flare for the show "that they knew was designed exclusively for outside use," but was much cheaper than indoor flares.
Arigony also ran down a long list of nightclub security violations, including a lack of emergency lights, fire extinguishers that did not work and may have been only for show, and an overcrowded dance floor.
Police were also trying to find the footage from the security cameras.
"The video cameras weren't in the nightclub (where they were supposed to be) and there was no computer with memory for storage," said prosecutor Veruska Agostine.
The club owners claim the surveillance system had not been working for two months.
Police also were searching for the club's cash register, which could help determine whether the establishment was overcrowded.
Some survivors said they saw the vocalist of the Gurizada Fandangueira band light the fireworks at around 2:00 am (0400 GMT) Sunday, when the fire broke out.
The drama was caused by "the use of fireworks in a closed space" where there were "too many people," Major Jerson da Rosa Pereira of Santa Maria's fire department told AFP.
The club, which was open despite an expired license, had only one working exit that, according to survivors, was unmarked and blocked by steel barriers, which made it difficult to get out.
Some 180 bodies were found in the bathrooms, which many panicked party-goers had apparently confused with emergency exits.
Some survivors also said that security guards initially blocked the exit as they tried to stop customers from leaving without paying their bar tabs.
Most of the victims died of smoke inhalation in their desperate bid to escape.
Health Minister Alexandre Padilha said the death toll was at 234, while 75 people remain in intensive care in serious condition.
The state of Rio Grande do Sul, where Santa Maria is located, has frozen the assets of both the club owners and their company.
Meanwhile, mayors of several cities announced more stringent oversight of nightclubs during their annual meeting with President Dilma Rousseff. In the Amazon city of Manaus, Mayor Arthur Virgilio Neto closed down and fined 15 nightclubs that were not up to code.
The head of Brazil's lower house of Congress also said he was forming a committee to come up with federal safety codes to prevent such fires and harmonize local and state regulations.
The Brazilian blaze even led Nicaraguan President Daniel Ortega to issue an order Tuesday banning all pyrotechnics at indoor entertainment centers.
As anger mounted, some 15,000 people marched through Santa Maria late Monday demanding justice for the dead.
"I know that my daughter isn't coming back. But somebody has to pay for this," said marcher Jorge Neves, who lost his daughter Rafaella.
Mario Birnfeld do Canto, a doctor at the private Caridade Hospital, went through a cruel twist of fate: having to treat his own 18-year-old daughter, Mariana, after the tragedy. He was unable to save her.
"I never have seen anything like this. Almost 300 young people piled up and suffocated to death. We as a Brazilian society cannot allow this to happen, for 300 kids to die like that," he said.
What the stars mean:
★ Poor ★ ★ Promising ★★★ Good ★★★★ Very good ★★★★★ Exceptional