UMA Audit

OpenZeppelin28 Apr 2020Repository at commit 9d403dd

Audit · firm’s term: audit

OpenZeppelin reviewed UMA (UMA Audit) on 28 Apr 2020: 29 findings, 0 critical; 21 marked fixed, 2 acknowledged, 6 open.

No open critical findings

Open the report Open UMA’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings29

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	3
Medium	1	0	3
Low	5	2	15

High[H01] Votes can be duplicatedFixed

The report gives no description here.

High[H02] Governance actions that require ETH cannot be practically executedFixed

The report gives no description here.

High[H03] Any governance action could be executed multiple timesFixed

The report gives no description here.

Medium[M01] Token holders can react to revealed voteFixed

The report gives no description here.

Medium[M02] Fragile implementation of conversion from integer to UTF-8 representationFixed

The report gives no description here.

Medium[M04] Financial contract registration with repeated parties might lead to inconsistent behaviorsFixed

The report gives no description here.

Low[L01] Possibly miscalculated late penaltyFixed

The report gives no description here.

Low[L03] Roles cannot be renouncedFixed

The report gives no description here.

Low[L04] Missing error messages in require statementsFixed

The report gives no description here.

Low[L05] Lookup key strings are not centrally definedFixed

The report gives no description here.

Show 10 more

Low[L08] Lack of input validationFixed

The report gives no description here.

Low[L09] Repeated reward eventsFixed

The report gives no description here.

Low[L10] Transfer of ETH may unexpectedly failFixed

The report gives no description here.

Low[L11] Ever-growing array of pending price requestsFixed

The report gives no description here.

Low[L13] Nonexistent role can be set in Withdrawable contractFixed

The report gives no description here.

Low[L14] Lack of event emission after fee updateFixed

The report gives no description here.

Low[L15] Actions in proposals might fail silently when target is an externally-owned accountFixed

The report gives no description here.

Low[L16] Unsafe addition in reward’s expiration time calculationFixed

The report gives no description here.

Low[L18] Using unstable version of OpenZeppelin Contracts may break functionalityFixed

The report gives no description here.

Low[L19] Redundant and fragile ERC20 transferFixed

The report gives no description here.

Show 1 more

Low[L22] Use of uninitialized state variables in fee calculationFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (15)

https://github.com/UMAprotocol/protocol/core/contracts/common/implementation/FixedPoint.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/Registry.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/VoteTiming.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/ResultComputation.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/ContractCreator.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/interfaces/OracleInterface.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/common/implementation/Withdrawable.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/IdentifierWhitelist.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/interfaces/VotingInterface.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/Governor.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/common/implementation/MultiRole.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/Voting.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/interfaces/IdentifierWhitelistInterface.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/DesignatedVoting.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4
https://github.com/UMAprotocol/protocol/core/contracts/oracle/implementation/Store.sol at commit 9d403ddb5f2f07194daefe7da51e0e0a6306f2c4

Part of UMA’s security record

UMA

Audits6 audits by 1 firmLast audit Apr 2025, by OpenZeppelin.

Critical findingsNo open critical findingsAcross the 6 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.

Open UMA’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.