XHYPE security record

The function `updateUniswapV2Router()` does not check if the pair has been created. If the pair has already been created, then calling `createPair()` on the factory contract will always cause this function to revert, making it impossible to update the router to this address.

The contract allows the router address to be set arbitrarily during contract deployment. This introduces a potential vulnerability where a malicious router can be set during the contract deployment process. A malicious router could potentially behave in unexpected ways, leading to loss of funds or other vulnerabilities being exploited

The `setVestedWallet()` function can only be used for accounts with zero balance. Once an account is set to the vested wallet, will the project team transfer vested tokens to this account? If not, the users could use another address to trade the tokens to bypass the vesting check.

The variable `minBalanceForDividends` does not have a reasonable upper boundary, so it can be given an arbitrary value after deploying by the function `setMinBalanceForDividends()`. Only the users who have at least `minBalanceForDividends` amount of balance can get rewards.

The mapping `pointsCorrection` is declared and used in an important function `cumulativeDividendsOf()` of the `AbstractDividends` contract. However, the `pointsCorrection` can only be updated in two functions `_correctPointsForTransfer()` and `_correctPoints()`. Both functions are declared but never used. The logic of the `_correctPointsForTransfer` function seems to correct the `_withdrawableDividend`, however, the logic is incorrect. During the token transfer, the correct points should not be the pointsPerShare.mul(shares).toInt256(). It should be the _withdrawableDividend of the share which is hard to know in the current logic.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=1497 rewardToken = _rewardToken; ``` - `_rewardToken` is not zero-checked before being used. Additionally, the `rewardToken` must not be the XHP token, otherwise the function `swapEthForTokensAndDistribute()` will fail.

The mapping `excludedFromNukeTheWhales` is declared but never changed. The linked statements do not affect the functionality of the codebase and appear to be either remnants of test code or older functionality.

State variables that never change should be declared as `constant` to save gas. --- ```solidity=924 address private DEAD = 0x000000000000000000000000000000000000dEaD; ``` - `DEAD` should be declared `constant`.