Honorworld - Audit 2

The `emergencyWithdraw` function is provided to the user to retrieve the assets from the contract in an emergency. At the end code of the function, all the information of the user has been reset, but the global variable `pool.boostedSupply` of the current pool is not subtracted from the variable `user.boostedAmount`.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=85 buybackPool = _buybackPool; ``` - `_buybackPool` is not zero-checked before being used. --- ```solidity=86 devaddr = _devAddress; ``` - `_devAddress` is not zero-checked before being used. --- ```solidity=102 devaddr = _devAddress; ``` - `_devAddress` is not zero-checked before being used.

State variables initialized when declared are equivalent to initializing them inside the constructor. Therefore, initializing state variables when declared in an upgradeable contract has no actual effect since the constructor of an upgradeable contract is never called.