Uno

CertiKFiles named in the report

CertiK reviewed UNO.farm (Uno) on 12 Sep 2022: 17 findings, 0 critical; 10 marked fixed, 7 open.

No open critical findings
Open the reportOpen UNO.farm’s security record

Report hosted on skynet.certik.com.

Statuses are the security firm’s own, from this report. Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High300
Medium102
Low308
MediumIncorrect Calculation Of `reward`Fixed

Line 238 in `UnoFarmBalancer` rewards should be the changes of lp token balance in the farm contract before and after staking tokens to vault.

MediumRemaining Token Not ReturnedFixed

When the user calls the `deposit()` method to deposit assets to the vault, the contract only accumulates liquidity for the user and does not transfer the remaining token back to the user. The remaining token will be stayed in the balancer farm contract, while other farm contracts would transfer those remaining tokens back to user.

LowDiscussion about `transfer`Fixed

If the user calls the `transfer()` function to transfer `UNO-LP` more than `blockedLiquidty[user][lastMoveInfo.block]`, then the remaining leftover tokens corresponding to that `UNO-LP` can not be retrieved when calling `withdraw()`. For example, if A has 40 lp tokens and the `blockedLiquidty[A][lastMoveInfo.block]` is 10, the multiplier in line 187- 188 should be 30. If A transfers 15 lp tokens to B, the multiplier would be 25 and A will never be able to retrieve those leftover tokens.

LowIncompatibility With Contract `UnoAssetRouterBalaFixed

The code in line 97 of contract UnoAutoStrategy returns two addresses, but the contract `UnoAssetRouterBalancer` method `getTokens()` returns an array. In UnoAssetRouterBalancer.sol ```solidity=159 function getTokens(address lpPool) external view returns(IERC20[] memory tokens){ bytes32 poolId = IBasePool(lpPool).getPoolId(); (tokens, , ) = Vault.getPoolTokens(poolId); } ``` The code in line 141 of contract UnoAutoStrategy mentions the two variables, sentA and sentB, receiving from `pool.assetRouter.deposit`, but the contract `UnoAssetRouterBalancer` only returns one. ```solidity=159 function deposit(address lpPool, uint256[] memory amounts, address[] memory tokens, uint256 minAmountLP, uint256 amountLP, address recipient) external whenNotPaused returns(uint256 liquidity){ ```

LowMissing Zero Address ValidationFixed

Addresses should be checked before assignment or external calls to make sure they are not zero addresses.

LowNo empty initializer constructor for UUPS upgradaFixed

It's recommended the team verify the UUPS implementation contract is initialized correctly. Besides initializing the contract, another way to prevent the implementation contract from being used is to invoke the "_disableInitializers" function in the constructor to automatically lock it when it is deployed. For more information, please refer to: https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#initializing_the_implementation_contract

LowRedundant `import` StatementFixed

The interface `IWMATIC.sol` is imported, but not used.

LowRedundant Code ComponentsFixed

Line 124 code is basically the same as line 125 code, just different error message. ```solidity=124 require ((amounts.length == poolTokens.length) && (tokens.length == poolTokens.length), 'BAD_AMOUNTS_LENGTH'); require ((amounts.length == poolTokens.length) && (tokens.length == poolTokens.length), 'BAD_TOKENS_LENGTH'); ```

LowUnchecked ERC-20 `transfer()`/`transferFrom()` CaFixed

The return value of the transfer()/transferFrom() call is not checked. ```solidity=176 IERC20(lpPool).transfer(recipient, amount); ```

LowVariables That Could Be Declared as ImmutableFixed

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (62)

  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IRewarder.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IUnoAssetRouter.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/balancer/interfaces/IUnoFarmBalancer.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/quickswapDual/interfaces/IUnoFarmQuickswapDual.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/balancer/interfaces/IUnoAssetRouterBalancer.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IUnoAccessManager.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/quickswap/UnoAssetRouterQuickswap.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/UnoFarmFactory.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStable/UnoFarmTrisolarisStable.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/balancer/UnoFarmBalancer.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/quickswapDual/UnoFarmQuickswapDual.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IUnoFarm.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IUnoFarmFactory.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IUniswapV2Pair.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/sushiswap/interfaces/IUnoAssetRouterSushiswap.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IStakingDualRewards.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IMiniChefV2.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IUnoFarmFactory.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IUniswapV2Router.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStable/UnoAssetRouterTrisolarisStable.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IWMATIC.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IOdosRouter.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IBasePool.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/quickswap/interfaces/IUnoAssetRouterQuickswap.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IUnoAutoStrategyFactory.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStandard/interfaces/IUnoFarmTrisolarisStandard.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IChildChainStreamer.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/autostrategy/UnoAutoStrategyFactory.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStable/interfaces/IUnoAssetRouterTrisolarisStable.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/ISwap.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/quickswap/UnoFarmQuickswap.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/balancer/UnoAssetRouterBalancer.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IComplexRewarder.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IUniswapV2Router02.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/quickswapDual/UnoAssetRouterQuickswapDual.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/sushiswap/interfaces/IUnoFarmSushiswap.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStable/interfaces/IUnoFarmTrisolarisStable.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IAsset.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IUnoAssetRouter.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IUniswapV2Pair.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStable/test/UnoAssetRouterTrisolarisStableV2.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IVault.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IUnoFarm.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IUniswapV2Router.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStandard/test/UnoAssetRouterTrisolarisStandardV2.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IRewarder.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IUnoAccessManager.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/sushiswap/UnoAssetRouterSushiswap.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/autostrategy/UnoAutoStrategy.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/quickswap/interfaces/IUnoFarmQuickswap.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStandard/UnoAssetRouterTrisolarisStandard.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStandard/UnoFarmTrisolarisStandard.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/UnoAccessManager.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/interfaces/IUniversalMasterChef.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IRewardsOnlyGauge.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/UnoFarmFactory.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/sushiswap/UnoFarmSushiswap.sol
  • 0e19aeb9e7ed803b9810167ac53def5169516c46/contracts/apps/trisolarisStandard/interfaces/IUnoAssetRouterTrisolarisStandard.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IStakingRewards.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/interfaces/IChildChainLiquidityGaugeFactory.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/UnoAccessManager.sol
  • 005fac42cbc16679830e6a006b3816b399c8750c/contracts/apps/quickswapDual/interfaces/IUnoAssetRouterQuickswapDual.sol

Part of UNO.farm’s security record

UNO.farm
Audits1 audit by 1 firmLast audit Sep 2022, by CertiK.
Critical findingsNo open critical findingsIn 1 report.
Open UNO.farm’s security record

Security firm

CertiK

1,044 projects reviewed · 1,393 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us