OMNIA Protocol

CertiKRepository at commit b5098ad

CertiK reviewed Omnia Protocol on 11 Oct 2024: 17 findings, 0 critical; 13 marked fixed, 2 acknowledged, 2 open.

No open critical findings
Open the reportOpen Omnia Protocol’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High201
Medium000
Low0212
Low`uint32` may be short for `timestamp`Acknowledged

According to Linux doc(https://man7.org/linux/man-pages/man2/time.2.html), "Applications intended to run after 2038 should use ABIs with time_t wider than 32 bits." ```solidity=717 _stakes[stakeId].withdrawnTimestamp = StakingUtils.toUint32(block.timestamp); ``` If the `block.timestamp` was greater than $$2^{32} - 1$$ (4294967295) , it will revert the transaction.

LowPotential Risks Arising from Project DesignAcknowledged

The auditing team has raised the following inquiries concerning the design of the project: 1. There are concerns about potential delays in users being able to unstake their tokens if measurements are not added promptly. We would like to know how long after an epoch ends does the Supervisor add the measurement data for that specific epoch. 2. Once users have staked their tokens, they must wait until the end of the epoch in which their stake expires to unstake. During this period, users are unable to perform an emergency withdrawal. For instance, if a user has staked for the duration of 10 epochs and wishes to withdraw mid-term due to poor performance of the node, currently, this is not permitted. Is this restriction by design? 3. In the `_addMeasurement()` function, measures are added to address potential malicious behavior from supervisors, allowing new supervisors to update measurements linked to the `nodeId`. However, a concern arises regarding the potential impact of malicious measures during the 48-hour waiting period before the execution of methods such as `revokeRole()` or `emergencyPause()`. This delay could allow the effects of malicious measures to persist. Does the team have any contingency plans to mitigate losses resulting from user transactions during this waiting period? 4. We'd like to check with the team the mechanism governing the transfer of rewards into the contract, including the timing and quantity. If rewards are not promptly transferred or if the transferred amount is insufficient, it could potentially hinder the execution of the `unstakeTokens()` function, thereby preventing users from withdrawing their staked principal and rewards as intended.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (6)

  • https://github.com/omniaprotocol/staking-contract/src/TimelockAdmin.sol at commit b5098ad7858a831e92422a5a37706c55c1b68ce3
  • https://github.com/omniaprotocol/staking-contract/src/Staking.sol at commit c2b47c814b23196fa17f3d5ea7c3b016e0d5ee52
  • https://github.com/omniaprotocol/staking-contract/src/Staking.sol at commit c2ae58e0a056e6153905d05b16070ae6f3a84caa
  • https://github.com/omniaprotocol/staking-contract/src/TimelockAdmin.sol at commit 765397db8afe9306cab533902757aee5f4560f24
  • https://github.com/omniaprotocol/staking-contract/src/Staking.sol at commit b5098ad7858a831e92422a5a37706c55c1b68ce3
  • https://github.com/omniaprotocol/staking-contract/src/Staking.sol at commit 765397db8afe9306cab533902757aee5f4560f24

Part of Omnia Protocol’s security record

Omnia Protocol
Audits1 audit by 1 firmLast audit Oct 2024, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open Omnia Protocol’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us