USPD security record

The smart contract contains several functions access controlled by administrative users with privileged rights in charge of performing admin tasks such as minting and burning tokens. These users need to be trusted not to perform malicious updates on the contract.

The Chainlink network uses a technology called Sequencers in their Off-Chain Reporting protocol. Sequencers help in improving data transmission efficiency by enabling transaction aggregation and submitting data on-chain in batches.It is crucial for the protocol to verify the status of the Chainlink sequencer involved. Not checking the sequencer's status might lead to scenarios where the protocol is working with outdated, inaccurate, or even completely missing data. This could potentially lead to incorrect operation of the contracts or even financial loss, depending on the role of the oracle data.

The protocol provides first minter a 125% threshold to liquidate other positions and then this benefit decreases by a 5% until the default 110%. As there is no access control on the minting process, this function can be frontrun by other users to obtain an advantageous position.

Throughout the protocol there are multiple instances where input parameters are not being validated against the Zero Address, most of which are used to perform external calls, allowing for undefined behavior within the protocol.It should be noted that although this occurs mostly in the constructor, mistakes can be made by the deployer of the smart contracts, allowing for unwanted transactions to take place in the future.

It was observed that throughout the protocol there are multiple instances of redundant code on several accounts:Invariant testing within the source code. Invariant testing should be done mostly within test files;Variables and values related to testing environments;Redundant functions, e.g. mint() and mintShares();These design patterns increase code complexity and do not maximize transaction gas and storage efficiency on the blockchain.