Honorworld - Audit

In the contract `HWTToken` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and set the mainPool address.  In the contract `HWTToken` the role `mainPool` has authority over the functions shown in the diagram below. Any compromise to the `mainPool` account may allow the hacker to take advantage of this authority and mint HWT to an arbitrary address. 

In the contract `LPStaking` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and add new liquidity pools and modify the allocation points of the existing ones.  In the contract `LPStaking` the role `devAddress` has authority over the functions shown in the diagram below. Any compromise to the `devAddress` account may allow the hacker to take advantage of this authority to change the `devAddress` address, which receives fees when a withdrawal takes place. 

In the contract `NFTStaking` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and arbitrarily set `ApprovedMinter` and `ApprovedOperator` roles, as well as the AuraRule address.  -------------------------------- The role `ApprovedMinter` has the authority to function `directStake()` to stake token on other user's behalf. The role `ApprovedOperator` has the authority to the following functions to manage NFT tokens' ownership: - `escrowOwnership()` - `restoreOwnership()` - `transferOwnership()` Any compromise to the `ApprovedMinter` or `ApprovedOperator` account may allow the hacker to take advantage of this authority and stake or lock user's NFT tokens without their consent.

In the contract `StrategyPSC` the role `devAddress` has authority over the functions shown in the diagram below. Any compromise to the `devAddress` account may allow the hacker to take advantage of this authority and arbitrarily set `devAddress`, which receives the dev fees.  In the contract `StrategyPSC` the role `govAddress` has authority over the functions shown in the diagram below. Any compromise to the `govAddress` account may allow the hacker to take advantage of this authority and arbitrarily set multiple important addresses and disrupt normal contract process by pause/unpause.  In the contract `StrategyPSC` the role `harvestAddress` has authority over the functions shown in the diagram below. Any compromise to the `harvestAddress` account may allow the hacker to take advantage of this authority and take control over harvest and earn process.