UMA Audit – Phase 2

OpenZeppelinRepository at commit e6eaa48

Audit · firm’s term: audit

OpenZeppelin reviewed UMA (UMA Audit – Phase 2) on 12 May 2020: 12 findings, 0 critical; 9 marked fixed, 3 open.

No open critical findings
Open the reportOpen UMA’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High101
Medium103
Low105
High[H02] Sponsors can force liquidation of insolvent positionsFixed

The report gives no description here.

Medium[M01] Sponsors can delay liquidationsFixed

The report gives no description here.

Medium[M02] Passed withdrawal request might not be withdrawableFixed

The report gives no description here.

Medium[M03] Unregistered partiesFixed

The report gives no description here.

Low[L01] Violation of Checks-Effects-Interactions patternFixed

The report gives no description here.

Low[L02] Lack of input validationFixed

The report gives no description here.

Low[L04] Unsafe additionFixed

The report gives no description here.

Low[L05] Erroneous docstrings and commentsFixed

The report gives no description here.

Low[L06] Missing error messages in require statementsFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (6)

  • https://github.com/UMAprotocol/protocol/core/contracts/financial-templates/implementation/TokenFactory.sol at commit e6eaa48124ae3f209fb117cf05eb18292cf26d21
  • https://github.com/UMAprotocol/protocol/core/contracts/financial-templates/implementation/FeePayer.sol at commit e6eaa48124ae3f209fb117cf05eb18292cf26d21
  • https://github.com/UMAprotocol/protocol/core/contracts/financial-templates/implementation/ExpiringMultiPartyCreator.sol at commit e6eaa48124ae3f209fb117cf05eb18292cf26d21
  • https://github.com/UMAprotocol/protocol/core/contracts/financial-templates/implementation/SyntheticToken.sol at commit e6eaa48124ae3f209fb117cf05eb18292cf26d21
  • https://github.com/UMAprotocol/protocol/core/contracts/financial-templates/implementation/PricelessPositionManager.sol at commit e6eaa48124ae3f209fb117cf05eb18292cf26d21
  • https://github.com/UMAprotocol/protocol/core/contracts/financial-templates/implementation/Liquidatable.sol at commit e6eaa48124ae3f209fb117cf05eb18292cf26d21

Part of UMA’s security record

UMA
Audits6 audits by 1 firmLast audit Apr 2025, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 6 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.
Open UMA’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us