Helper Coin - Audit

In the contract `Ownable` the role `_owner` has authority over the functions shown in the diagram below. Any compromise to the `_owner` account may allow the hacker to take advantage of this authority and renounce or transfer the ownership.  In the contract `HELPERCOIN`, the role `caller` has authority over the following functions. Any compromise to the `caller` account may allow the hacker to take advantage of this authority, distribute tokens, and set DEXes. - `rewardPrimeHolders()` - `rewardPrimeHoldersWithInput()` - `setIsDex()` - `distributePrimeHoldersRewardManually()` - `preSale()` In the contract `HELPERCOIN`, the role `_development_withdrawer_address` can withdraw `development_address`'s tokens, the role `_legal_and_backup_withdrawer_address` can withdraw `legal_and_backup_address`'s tokens, and the role `_marketing_withdrawer_address` can withdraw `marketing_address`'s tokens. Any compromise to the withdrawers may allow the hacker to take advantage of this authority and withdraw tokens from those fee receivers.

```solidity=145 _mint(msg.sender, (75 * initialTotalSupply) / 100); _mint(_core_holders_address, (25 * initialTotalSupply) / 100); ``` `initialTotalSupply` amount of the HLPR tokens is sent to the contract deployer and `_core_holders_address` when deploying the contract. This could be a centralization risk as the deployer can distribute these tokens without obtaining the consensus of the community.

```solidity=415 for (uint256 i; i < holdersArrayLength; i++) ``` The value of variable `holdersArrayLength`, which stands for the number of token holders, could be very large and makes function `rewardPrimeHolders` extremely gas-consuming. ```solidity=406 reward_array_info = RewardArrayInfo( new address[](holdersArrayLength), new address[](holdersArrayLength), new address[](holdersArrayLength), new address[](holdersArrayLength), new address[](holdersArrayLength), new address[](holdersArrayLength) ); ``` ```solidity=548 for (uint256 i; i < reward_array_info.afterSlot6days.length; i++) { holdersMap[reward_array_info.afterSlot6days[i]].slot6Rewarded = true; _distribute( prime_holders_address, reward_array_info.afterSlot6days[i], reward_per_user_info.rewardAfterSlot6PerUser ); } ``` The iteration of `reward_array_info` is also costly. It is very likely that most variables in array `reward_array_info.afterSlot6days` are zero addresses because the length of array `reward_array_info.afterSlot6days` is the amount of all holders but only holders who hold HLPR more than 720 days are qualified to get rewards. This makes the loop costly.

```solidity=745 if ( _holdStruct.daysRewarded >= _slotDaysInfo.slot6Days || _numberDaysHold > _slotDaysInfo.slot6Days * 1 days || _isExemptFromReward[_holdersArray[i]] || _principalForReward == 0 ) { continue; } ``` A token holder is supposed to get daily rewards for up to 720 days. However, if he holds tokens for more than 720 days, which satisfies the condition `_numberDaysHold > _slotDaysInfo.slot6Days * 1 days`, he could lose the reward for the last `720 - _numberDaysHold` days.