Honorworld - Audit

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. A failure to discount such fees may allow the same user to withdraw more token than the contract initially received, causing loss in the contract, or failure in transaction. [Reference]( https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f) Contract `LPStaking` and `StrategyPSC` are not compatible with deflationary tokens, as they refer to input argument for the deposit and withdraw amounts instead of token amounts that the contract actually received

1. Function `_calculateAddition()` `_calculateDeletion()` and `_check_levelup_rule()` take input argument `_amounts` as uint256 array, while the calculation changes it to uint16, which might cause overflow. ```solidity=595 _user.qc[quality-1] += uint16(_amounts[i]); ``` 2. Function `_check_levelup_rule()` take input argument `_ids` as uint256 array, while the external call changes it to uint16, which might cause overflow. ```solidity=264 (, uint8 race, , ,) = heroRule.getCodeRule(uint16(_ids[i]));; ```

The contracts are serving as the underlying entity to interact with multiple external or third party protocols (listed below). The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. Contract `LPStaking` - Depends on external `rewardSupplier` to transfer in rewards. - Depends on Soul token balance to calculated the boosted shares for users. Contract `NFTStaking` - Depends on external NFT `heroNFT1155` and `heroNFT` as the contract accepts these NFT tokens to stake. - Depends on external `heroRule` and `auraRule` to calculate user share and to check level-up rule. - Depends on external `rewardSupplier` for rewards. Contract `StrategyPSC` - Depends on third-party PancakeSwap farm `farmContractAddress` to gain rewards. - Depends on third-party PancakeSwap router `uniRouterAddress` to swap reward tokens and add as liquidity. - Depends on `wbnbAddress` to wrap BNB. - interacts with third-party ERC20 tokens: `wantAddress`, `token0Address`, `token1Address` and `earnedAddress`.