Umbrella Network 3

CertiK29 Apr 2022Files named in the report

CertiK reviewed Umbrella Network (Umbrella Network 3) on 29 Apr 2022: 5 findings, 0 critical; 3 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open Umbrella Network’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	1	0
Medium	0	0
Low	1	3

LowImproper Usage of `public` and `external` TypeFixed

`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.

LowMissing Emit EventsFixed

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowPotential Underflow in the function `rescueToken(Fixed

The function `rescueToken()` is a centralized function that is used to rescue the accidentally transferred tokens. The check on L169 is used to ensure that the users' staking tokens will not be transferred out. ```solidity=167 function rescueToken(ERC20 _token, address _recipient, uint256 _amount) external onlyOwner() { if (address(_token) == address(stakingToken)) { require(_totalSupply <= stakingToken.balanceOf(address(this)) - _amount, "amount is too big to rescue"); } else if (address(_token) == address(rewardsToken)) { revert("reward token can not be rescued"); } _token.transfer(_recipient, _amount); } ``` SafeMath from OpenZeppelin is not used in the check on L169 which makes it possible for underflow and will lead to an inaccurate calculation result. The result of `stakingToken.balanceOf(address(this)) - _amount` may underflow. As a result, the check may not actually in effect when the `_token.transfer()` has special logic.