Honor World Token security record

The `emergencyWithdraw` function is provided to the user to retrieve the assets from the contract in an emergency. At the end code of the function, all the information of the user has been reset, but the global variable `pool.boostedSupply` of the current pool is not subtracted from the variable `user.boostedAmount`.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=85 buybackPool = _buybackPool; ``` - `_buybackPool` is not zero-checked before being used. --- ```solidity=86 devaddr = _devAddress; ``` - `_devAddress` is not zero-checked before being used. --- ```solidity=102 devaddr = _devAddress; ``` - `_devAddress` is not zero-checked before being used.

State variables initialized when declared are equivalent to initializing them inside the constructor. Therefore, initializing state variables when declared in an upgradeable contract has no actual effect since the constructor of an upgradeable contract is never called.

Function `balanceOf()` in `LPStaking` shares the same name as the function to check token balance in standard ERC20. Function `ownerOf()` in `NFTStaking` shares the same name as the one in standard ERC721. It may cause confusion to users to use similar names.

Performing integer division before multiplication truncates the low bits, losing the precision of calculation. ```solidity=266 uint256 boost = sharesSupply.mul(userWeight).div(totalWeight).mul(100 - TOKENLESS_PRODUCTION).div(100); ```

The functions which are never called internally within the contract should have external visibility for gas optimization. LPStaking: - `setDevAddress()` - `addPool()` - `setPool()` - `deposit()` - `withdraw()` NFTStaking: - `setApprovedMinter()` - `setApprovedOperator()` - `setAuraRule()` - `stake()` - `unstake()` - `claim()` - `levelup()` - `ownerOf()` - `onERC1155BatchReceived()` - `onERC1155Received()` StrategyPSC: - `deposit()` - `farm()` - `withdraw()` - `earn()` - `convertDustToEarned()` - `pause()` - `unpause()` - `setSettings()` - `setGov()` - `setOnlyGov()` - `setUniRouterAddress()` - `setRewardsAddress()` - `setDevAddress()` - `setHarvestAddress()` - `inCaseTokensGetStuck()` - `wrapBNB()`

In function `escrowOwnership()`, `restoreOwnership()` and `transferOwnership()` takes the ERC1155 token ID and amounts as arrays. The length of the two arrays are not compared and confirmed, which might cause issue when incorrect number of input is provided.

Variable `controllers` in `HWTToken` is never used in the contract. ```solidity=24 mapping(address => bool) controllers; ``` Variable `hwtAddress` in `strategyPSC` is never used in the contract. ```solidity=34 address public hwtAddress; ```

State variable `controllerFee` in contract `StrategyPSC` could be declared as `constant` since it is never modified. The following variables assigned in the constructor can be declared as `immutable`. `LPStaking`: - `buybackPool` `StrategyPSC`: - `isAutoComp` - `farmContractAddress` - `pid` - `wantAddress` - `token0Address` - `token1Address` - `earnedAddress` - `wbnbAddress` - `lpStakingAddress` Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of constant and immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.