Umia
Certora reviewed Umia on 8 Apr 2026: 18 findings, 0 critical; 15 marked fixed, 3 acknowledged.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 2 | 3 |
| Low | 0 | 1 | 10 |
HighTWAP initial snapshot dilutionFixed
The report gives no description here.
HighUser CPMM LP Permanently Lost at SettlementFixed
The report gives no description here.
MediumAssets might stuck permanently after liquidation startsFixed
The report gives no description here.
MediumLeftover tokens stuck permanently in UmiaMarketManager after re-adding liquidity to Uniswap V4 during market settlementFixed
The report gives no description here.
Mediummigrate() always fails when currency is ETH because UmiaLBP cannot accept native ETHFixed
The report gives no description here.
LowConditional market swap applies two fee layers and effective fee exceeds conditionalMarketFeeBpsFixed
The report gives no description here.
LowCreateMarket does not validate executionPayload and winning proposal may not executeFixed
The report gives no description here.
LowDuplicate assets in `LIQUIDATE_TREASURY` payloads allow users to drain the treasury via multiple payoutsFixed
The report gives no description here.
LowExecutor's `ActionType.CALL` enables unauthorized address(0) upgrade and beacon resetFixed
The report gives no description here.
LowLP NFT withdrawal permanently breaks market creationFixed
The report gives no description here.
Show 5 more
LowMigration uses fixed reserveTokenAmount and ignores swept unsold tokens in calculating liquidity to initialize UniswapV4 PoolFixed
The report gives no description here.
LowPaused QOrg Token blocks liquidation claims after liquidation startsFixed
The report gives no description here.
LowThreshold and config changes affect active marketsFixed
The report gives no description here.
LowTWAP cardinality slot filling enables permissionless DoS on market creation and settlementFixed
The report gives no description here.
LowUnbounded string lengths in `uploadDocument` allow for permanent state bloat and gas limit DoSFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Umia’s security record
UmiaSecurity firm
Certora9 projects reviewed · 17 reports · latest Jun 2026
See Certora’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us