UMA security record
As of 14 Oct 2026, UMA has 6 audit reports by 1 security firm on Trustblock; the latest is by OpenZeppelin, dated 30 Apr 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits6
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| UMA Oracle Bridging Contracts Upgrade Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit a005938 | No open critical findings | Open · blog.openzeppelin.com |
| UMA DVM 2.0 Incremental Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 5682c65 | No open critical findings | Open · blog.openzeppelin.com |
| UMA DVM 2.0 Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 7938617 | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| UMA Optimistic Governor Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit fca8e24 | No open critical findings | Open · blog.openzeppelin.com |
| UMA Audit – Phase 2 | Security firm: OpenZeppelin | Date: | Scope: Repository at commit e6eaa48 | No open critical findings | Open · blog.openzeppelin.com |
| UMA Audit | Security firm: OpenZeppelin | Date: | Scope: Repository at commit 9d403dd | No open critical findings | Open · blog.openzeppelin.com |
Findings79
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 1 | 0 | 5 |
| Medium | 7 | 0 | 11 |
| Low | 11 | 2 | 41 |
CriticalSlashing mechanism grants exponentially more rewards than expectedUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportHighDuplicate Request RewardsUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportHigh[H02] Sponsors can force liquidation of insolvent positionsUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportHigh[H01] Votes can be duplicatedUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportHigh[H02] Governance actions that require ETH cannot be practically executedUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportHigh[H03] Any governance action could be executed multiple timesUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportMediumLack of validation in EmergencyProposer setQuorum and setMinimumWaitTimeUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportMediumIncorrect math in slashing library commentsUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportMediumChange of collateral could result in unintended bond valueUMA Optimistic Governor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportMediumLack of event emission after sensitive actionsUMA Optimistic Governor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportShow 10 more
MediumLack of input validationUMA Optimistic Governor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportMedium[M01] Sponsors can delay liquidationsUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportMedium[M02] Passed withdrawal request might not be withdrawableUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportMedium[M03] Unregistered partiesUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportMedium[M01] Token holders can react to revealed voteUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportMedium[M02] Fragile implementation of conversion from integer to UTF-8 representationUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportMedium[M04] Financial contract registration with repeated parties might lead to inconsistent behaviorsUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLowOracle Upgrades Can Make Prices InaccessibleUMA Oracle Bridging Contracts Upgrade Audit · OpenZeppelin · 30 Apr 2025Fixed
The report gives no description here.
Open the reportLowGovernor contract can create emergency proposalsUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportLowIncorrect public visibilityUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowLack of address validation in setExecutorUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportLowMissing error messages in require statementsUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportLowMissing modifier onlyIfNotMigrated enables new price requests on migrated contractsUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportLowMissing test coverageUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportLowNonintuitive behavior of payable transactions in executeEmergencyProposalUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportLowUnlocked Solidity version pragmaUMA DVM 2.0 Incremental Audit · OpenZeppelin · 8 Dec 2022Fixed
The report gives no description here.
Open the reportLowDuplicate function executionUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportLowImprecise function nameUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportLowIncorrect documentation for voting commit hashUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportLowLack of input verification in library functionsUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowMissing error messages in require statementsUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportLowStaker contract should be declared abstractUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportLowTestcode in productionUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportLowWithdraw role is not configuredUMA DVM 2.0 Audit · OpenZeppelin · 2 Dec 2022Fixed
The report gives no description here.
Open the reportLowDuplicated codeUMA Optimistic Governor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportLowEvents lacking informationUMA Optimistic Governor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportLowMisleading inline documentationUMA Optimistic Governor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportLowProposals can be deleted repeatedlyUMA Optimistic Governor Audit · OpenZeppelin · 21 Jul 2022Fixed
The report gives no description here.
Open the reportLow[L01] Violation of Checks-Effects-Interactions patternUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportLow[L02] Lack of input validationUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportShow 10 more
Low[L04] Unsafe additionUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportLow[L05] Erroneous docstrings and commentsUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportLow[L06] Missing error messages in require statementsUMA Audit – Phase 2 · OpenZeppelin · 12 May 2020Fixed
The report gives no description here.
Open the reportLow[L01] Possibly miscalculated late penaltyUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L03] Roles cannot be renouncedUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L04] Missing error messages in require statementsUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L05] Lookup key strings are not centrally definedUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L08] Lack of input validationUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L09] Repeated reward eventsUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L10] Transfer of ETH may unexpectedly failUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportShow 8 more
Low[L11] Ever-growing array of pending price requestsUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L13] Nonexistent role can be set in Withdrawable contractUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L14] Lack of event emission after fee updateUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L15] Actions in proposals might fail silently when target is an externally-owned accountUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L16] Unsafe addition in reward’s expiration time calculationUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L18] Using unstable version of OpenZeppelin Contracts may break functionalityUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L19] Redundant and fragile ERC20 transferUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportLow[L22] Use of uninitialized state variables in fee calculationUMA Audit · OpenZeppelin · 28 Apr 2020Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="uma"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us