HedgePay security record

According to the logic of the function `calculateFee()`, if the `_transfer` happened during the selling process, `sellFee` will be deducted. However, it is a little strange that during not only the buying process but also the wallet transfer process, `buyFee` will be deducted too. Is this your design?

In extreme case, related fees could be very large amount of value, which might cause unexpected loss to the project and users.

The state variable `feeDistributionMinAmount` is used to compare with the return value of `balanceOf()` function. The decimals of return value of `balanceOf()` function is 18. However, the default value of the state variable `feeDistributionMinAmount` seems too small. This means that the amount of current token contract can be greater than it easily. This causes the distribute fee to be called frequently.

The function that affects the status of sensitive variables should be able to emit events.

1. The input value `from/to` are missing the check for the non-zero address. 2. The input value `amount` is missing the check for the non-zero value.

The given input is missing the check for the non-zero address.

The contract serves as the underlying entity to interact with third parties `feeManager` and `rewardsManager` protocols. The audit scope treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised, which may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Since `HedgePay` token can be burned, `totalSupply()` may be decreased sometimes and hence that the amount left to be minted may become larger and larger based on the require condition in #L117. This means that `MINTER_ROLE` can mint more tokens than `MAX_SUPPLY`. ```solidity=116 function _mint(address account, uint256 amount) internal override { require(totalSupply() + amount <= MAX_SUPPLY, "cap exceeded"); uint256 oldBalance = balanceOf(account); super._mint(account, amount); if (address(rewardsManager) != address(0)) { rewardsManager.notifyBalanceUpdate(account, oldBalance); } } ```

The comment at #L34 contains a typo, namely `grather`. The comment at #L50 contains a typo, namely `esential`. The comment at #L160 contains a typo, namely `allready`.

Event `Log()/LogBytes()` are declared but never used.