Opulous (Staking Pools) Addendum

CertiK4 Nov 2022Code version: not recorded (see the report)

CertiK reviewed Opulous (Opulous (Staking Pools) Addendum) on 4 Nov 2022: 5 findings, 0 critical; 3 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open Opulous’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	2	0
Medium	0	1
Low	0	2

HighCentralization Related RisksAcknowledged

In the contract `staking-pool-two-tokens-approval`, the role `admin` has authority over the following functions: - setup() - add_whitelist() - remove_whitelist() - close() - set_admin_address() - set_max_pool_size() - set_max_share() - set_end_timestamp() - set_lockup_and_apy() - defund() Any compromise to the `admin` account may allow a hacker to take advantage of this authority.

HighDependency on Foreign AssetsAcknowledged

The scope of this project deals with the transfer of foreign assets, e.g: OPUL, MFT & USDC as either stake tokens or reward tokens. Algorand supports asset freezing and clawback for tokens, which might pose a risk to this program.