Honorworld - Audit

CertiK10 Oct 2022Files named in the report

CertiK reviewed Honor World Token (Honorworld - Audit) on 10 Oct 2022: 13 findings, 0 critical; 6 marked fixed, 4 acknowledged, 3 open.

No open critical findings

Open the report Open Honor World Token’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	4	0
Medium	0	0	0
Low	3	0	6

LowConfusing Function NamesFixed

Function `balanceOf()` in `LPStaking` shares the same name as the function to check token balance in standard ERC20. Function `ownerOf()` in `NFTStaking` shares the same name as the one in standard ERC721. It may cause confusion to users to use similar names.

LowDivide Before MultiplyFixed

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=266 uint256 boost = sharesSupply.mul(userWeight).div(totalWeight).mul(100 - TOKENLESS_PRODUCTION).div(100); ```

LowFunction Should Be Declared ExternalFixed

The functions which are never called internally within the contract should have external visibility for gas optimization. LPStaking: - `setDevAddress()` - `addPool()` - `setPool()` - `deposit()` - `withdraw()` NFTStaking: - `setApprovedMinter()` - `setApprovedOperator()` - `setAuraRule()` - `stake()` - `unstake()` - `claim()` - `levelup()` - `ownerOf()` - `onERC1155BatchReceived()` - `onERC1155Received()` StrategyPSC: - `deposit()` - `farm()` - `withdraw()` - `earn()` - `convertDustToEarned()` - `pause()` - `unpause()` - `setSettings()` - `setGov()` - `setOnlyGov()` - `setUniRouterAddress()` - `setRewardsAddress()` - `setDevAddress()` - `setHarvestAddress()` - `inCaseTokensGetStuck()` - `wrapBNB()`

LowLength of Input Array Not CheckedFixed

In function `escrowOwnership()`, `restoreOwnership()` and `transferOwnership()` takes the ERC1155 token ID and amounts as arrays. The length of the two arrays are not compared and confirmed, which might cause issue when incorrect number of input is provided.

LowUnused State VariablesFixed

Variable `controllers` in `HWTToken` is never used in the contract. ```solidity=24 mapping(address => bool) controllers; ``` Variable `hwtAddress` in `strategyPSC` is never used in the contract. ```solidity=34 address public hwtAddress; ```

LowVariables That Could Be Declared as Immutable orFixed

State variable `controllerFee` in contract `StrategyPSC` could be declared as `constant` since it is never modified. The following variables assigned in the constructor can be declared as `immutable`. `LPStaking`: - `buybackPool` `StrategyPSC`: - `isAutoComp` - `farmContractAddress` - `pid` - `wantAddress` - `token0Address` - `token1Address` - `earnedAddress` - `wbnbAddress` - `lpStakingAddress` Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of constant and immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.