CertiK reviewed Omnia Protocol on 11 Oct 2024: 17 findings, 0 critical; 13 marked fixed, 2 acknowledged, 2 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 2 | 0 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 2 | 12 |
According to Linux doc(https://man7.org/linux/man-pages/man2/time.2.html), "Applications intended to run after 2038 should use ABIs with time_t wider than 32 bits." ```solidity=717 _stakes[stakeId].withdrawnTimestamp = StakingUtils.toUint32(block.timestamp); ``` If the `block.timestamp` was greater than $$2^{32} - 1$$ (4294967295) , it will revert the transaction.
The auditing team has raised the following inquiries concerning the design of the project: 1. There are concerns about potential delays in users being able to unstake their tokens if measurements are not added promptly. We would like to know how long after an epoch ends does the Supervisor add the measurement data for that specific epoch. 2. Once users have staked their tokens, they must wait until the end of the epoch in which their stake expires to unstake. During this period, users are unable to perform an emergency withdrawal. For instance, if a user has staked for the duration of 10 epochs and wishes to withdraw mid-term due to poor performance of the node, currently, this is not permitted. Is this restriction by design? 3. In the `_addMeasurement()` function, measures are added to address potential malicious behavior from supervisors, allowing new supervisors to update measurements linked to the `nodeId`. However, a concern arises regarding the potential impact of malicious measures during the 48-hour waiting period before the execution of methods such as `revokeRole()` or `emergencyPause()`. This delay could allow the effects of malicious measures to persist. Does the team have any contingency plans to mitigate losses resulting from user transactions during this waiting period? 4. We'd like to check with the team the mechanism governing the transfer of rewards into the contract, including the timing and quantity. If rewards are not promptly transferred or if the transferred amount is insufficient, it could potentially hinder the execution of the `unstakeTokens()` function, thereby preventing users from withdrawing their staked principal and rewards as intended.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (6)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us