0xRAM LabsAutomated Security Assessment

protocol

https://github.com/UMAprotocol/protocol
May 26, 2026 at 12:00 AMf5d38f88-87a
0/ 100
SECURE

Your protocol has 1 security issue — 1 Low severity.

Security Overview //

Security Overview

🟢

Access Control

Secure

🟢

Reentrancy Protection

Secure

🟢

Oracle Security

Secure

🟢

Upgrade Safety

Secure

🟢

Input Validation

Secure

🟢

Event Logging

Secure

Severity Breakdown

Critical
0
High
0
Medium
0
Low
1
Info
0
764Lines of Code
1Contracts Analyzed
20Detectors Run
93msScan Duration

Vulnerability Breakdown

Below is a comprehensive breakdown of the vulnerabilities discovered in your smart contracts. As part of our marketing outreach, we expose the highest-severity vulnerability for free.

Free Security InsightLowSWC-103

Floating pragma: `pragma solidity ^0.8.0`

FixedPoint.sol:2

Impact

The contract might be compiled with an untested compiler version, potentially introducing unexpected behavior or known compiler bugs.

Description

The Solidity version pragma `^0.8.0` is not locked to a specific compiler version. Different compiler versions may introduce different behavior, optimizations, or bugs.

Vulnerable Code

1 1 | // SPDX-License-Identifier: AGPL-3.0-only
2 >>> 2 | pragma solidity ^0.8.0;
3 3 |
4 4 | import "@openzeppelin/contracts/utils/math/SafeMath.sol";
5 5 | import "@openzeppelin/contracts/utils/math/SignedSafeMath.sol";

Recommendation

Lock the pragma to a specific version, e.g., `pragma solidity 0.8.20;`. Use the latest stable version for new contracts.

Suggested Fix

1pragma solidity 0.8.20; // Lock to specific version

Secure Your Protocol
Before Launch

This automated scan is just the surface. Our team of expert auditors conducts line-by-line manual reviews, formal verification, and economic simulations to ensure your protocol is battle-tested.

Initiate Priority Audit Intake

Or email us at audit@0xram.com (Contact form preferred for priority queueing)

145+
Protocols
$4.82B+
TVL Secured
0
Post-Audit Exploits

© 2026 0xRAM Labs. All rights reserved.

Disclaimer: This report was dynamically generated by our automated static analyzer. It does not replace a comprehensive, line-by-line manual code audit by senior cryptographers.