As of 3 Nov 2026, Umbrella Network has 2 audit reports by 1 security firm on Trustblock; the latest is by CertiK, dated 29 Apr 2022. Those reports list no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Umbrella Network 3 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| Umbrella 2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 3 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 5 | 1 | 3 |
`public` functions that are never called by the contract could be declared as `external`. `external` functions are more efficient than `public` functions.
Open the reportThere should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportThe function `rescueToken()` is a centralized function that is used to rescue the accidentally transferred tokens. The check on L169 is used to ensure that the users' staking tokens will not be transferred out. ```solidity=167 function rescueToken(ERC20 _token, address _recipient, uint256 _amount) external onlyOwner() { if (address(_token) == address(stakingToken)) { require(_totalSupply <= stakingToken.balanceOf(address(this)) - _amount, "amount is too big to rescue"); } else if (address(_token) == address(rewardsToken)) { revert("reward token can not be rescued"); } _token.transfer(_recipient, _amount); } ``` SafeMath from OpenZeppelin is not used in the check on L169 which makes it possible for underflow and will lead to an inaccurate calculation result. The result of `stakingToken.balanceOf(address(this)) - _amount` may underflow. As a result, the check may not actually in effect when the `_token.transfer()` has special logic.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="umbrella-network"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us