OMNIA Protocol

Updated the finding based on commit [b5098ad7858a831e92422a5a37706c55c1b68ce3](https://github.com/omniaprotocol/staking-contract/tree/b5098ad7858a831e92422a5a37706c55c1b68ce3). In the contract `StakingSettings` the role `_ADMIN_ROLE` has authority over the functions shown in the list below. - `setMinStakingAmount(uint256 amount)`: Sets the minimum amount of tokens that can be staked in the contract. - `setMaxStakingAmountPerNode(uint256 amount)`: Sets the maximum amount of tokens that can be staked per node. - `setMaxApy(NodeSlaLevel slaLevel, uint256 apy)`: Sets the maximum annual percentage yield (APY) that can be offered for a specific node service level agreement (SLA) level. - `setMinRps(uint24 rps)`: Sets the minimum requests per second (RPS) parameter used as part of the APY calculation. - `setMaxRps(uint24 rps)`: Sets the maximum RPS parameter used as part of the APY calculation. - `setNodeOwnerRewardPercent(uint16 percent)`: Sets the percentage of rewards that go to the node owner. - `setApyBoostMinPercent(uint16 percent)`: Sets the minimum percentage of APY boost that can be applied when staking for a long period. - `setApyBoostDeltaPercent(uint16 percent)`: Sets the delta percentage for APY boost calculations, which affects the scaling of APY boost over time. - `setApyBoostMaxDays(uint16 maxDays)`: Sets the maximum number of days over which the APY boost can scale. - `enableNFTApyBoost(address collection)`: Enables additional APY boost for NFT holders, setting the associated NFT collection. - `disableNFTApyBoost()`: Disables the NFT APY boost feature. - `changeNFTApyBoost(uint16 seekersBoost, uint16 commandersBoost, uint16 titansBoost)`: Changes the percentage boosts associated with different tiers of NFTs. - `setPenaltyRate(uint256 penaltyRate)`: Sets the penalty rate that will be applied when computing penalties for the staking contract. Any compromise to the `_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and change some important state variables. --- In the contract `Staking` the role `_ADMIN_ROLE` has authority over the functions shown in the list below. - `emergencyPause()`: Pauses all staking activities in the contract. This is a security feature typically used in emergency situations. - `emergencyResume()`: Resumes the contract operations after being paused. Any compromise to the `_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and change some important state variables. In the contract `Staking` the role `_SUPERVISOR_ROLE` has authority over the functions shown in the list below. - `addMeasurements(...)`: Adds performance measurements for nodes. This function can only be called by a supervisor role. Any compromise to the `_SUPERVISOR_ROLE` account may allow the hacker to take advantage of this authority and variables related to measurements can be modified for any nodeId. Furthermore, the contract inherits the `AccessControl` or `AccessControlUpgradeable` contract from OpenZeppelin, enabling the management of different roles. Within these contracts, the `DEFAULT_ADMIN_ROLE` is granted permission to assign or remove other roles. Any compromise to the `DEFAULT_ADMIN_ROLE` account may allow the hacker to take advantage of this authority and alter the association between roles and accounts at will.

In the `Staking` contract, the role `admin` has the authority to update the implementation contract behind the `Staking` contract. Any compromise to the `admin` account may allow a hacker to take advantage of this authority and change the implementation contract which is pointed by proxy and therefore execute potential malicious functionality in the implementation contract.