Uno Re v2.1 [Relaunch version]

Full docs can be viewed here - https://unore.gitbook.io/uno-re/investor-app/v2-penta-launch-dapp

Previous version was audited multiple times and reports can be found here https://github.com/Uno-Re/audit-reports and https://sourcehat.com/audits/CoverPortal/

Post our security incident https://medium.com/@uno.reinsure/security-incident-post-mortem-report-and-the-road-ahead-acb38aaf3f11 we have decided to make some enhancements on our contracts to improve security and increase decentralization of control

Changes in contracts

Capital Agent:

This contract manages and store sales policy and SSIP-SSRP pools capital and utilised funds

SingleSidedInsurancePool:

In this pool staker stake funds to generate rewards, and policyholder claims its policy in this contract

UMA integration:

User can claim its policy, by requesting to uma governance and dao can disputes this policy in uma, if policy is not rejected user can claim funds after delay

flow:

• When comes for claim, it call requestPayout function in SSIP pool
  • Which creates assertionId corresponds to policyId
  • This assertionId will be used to dispute and settle policyId in UMA governance
  • Set aliveness of assertionId in UMA, policy can not be settled if aliveness time is not passed
• If policy is rejected by dao, than it can call disputeAssertion function of UMA to reject assertionId
• After delay passed, user can settleAssertionId in UMA if there is not disputes than it will call assertionCallbackResolved function of SSIP to claim policy to user
• If there is a disputes in assertionId, it will not call assertionCallbackResolved function of SSIP

Issues:

• Only claim accessor can claim policy and there was no checks to check if claiming amount is valid or not

SingleSidedRensurancePool:

In this pool staker stake funds to generate rewards, and policyholder claims its policy in this contract

Issues:

• Only claim accessor can claim policy and there was no checks to check if claiming amount is valid or not

EscalatingManager:

To check if assertion is valid or not at the time of asserTruth and to disputes assertion id, as these function are called by OptimisticOracleV3

Counters:

Used to increment index of policy id and fetch current policy id As new package version of openzeppeline remove counter contract

ExchangeAgent:

Get oracle price feed data and used to convert currency amount for USDC and USDC to currency or token to token

PremiumPool:

Collect premium from user into this address and check for available currency to collect premium

Rewarder:

This contract used to distribute rewards to stake holder of SSIP and SSRP pools

RiskPool:

when user leave and enter in pools riskPool ERC20 token burns into their address, this contract function can only be called by SSIP-SSRP pools

SalesPolicy:

This contract provides a policy to the user to buy, and collect premium from the user. This policy is ERC721 token id which is burn and mint at the time of buy and sell policy

RiskPoolFactory:

Factory contract to create riskPool contract, call by SSIP and SSRP contract to create riskPool

RewarderFactory:

Factory contract to create rewarder contract, call by SSIP and SSRP contract to distribute rewards token

SalesPolicyFactory:

Factory contract to create salesPolicy contract.

SyntheticSSIPFactory:

Factory contract to create SyntheticSSIP contract, call by SSIP contract.

SyntheticSSRPFactory:

Factory contract to create SyntheticSSRP contract, call by SSRP contract.

Changes

• update solidity version to 0.8.23
• make CapitalAgent, SSIP and SSRP contract upgradable
• use upgradable contracts
• make Counters contract as it is removed in new version
• add getPolicyInfo function in CapitalAgent, to fetch policy information
• add pausable and pool kill functionality in transfer of funds, when there is a hack in protocol governance can deprecate protocol functionality to stop funds flow to hacker and prevent from loss of funds
  • add killPool and revivePool function
  • add pause and unpause function
  • add modifier to check pool alive or not In contracts: - ExchangeAgent - PremiumPool - Rewarder - SalesPolicy - SSIP - SSRP - SyntheticSSIP and SyntheticSSRP
• SSIP changes
  • remove Ownable and use AccessControl as more than one role is required
  • use admin role instead of owner
  • Make internal function to remove redundant code
  • Policy struct to store policy details in pools
  • requestPayout function to request policyId to uma governance
  • assertionResolvedCallback function called by uma to claim funds to policy holder
• SSRP changes
  • remove Ownable and use AccessControl as more than one role is required
  • use GUARDIAN_COUNCIL_ROLE to claim policy
  • use admin role instead of owner
  • pausable and kill pool functionality
  • add killPool and revivePool function
  • add pause and unpause function
  • add modifier to check pool alive or not
• Add enforceHasContractCode function in premium pool to check for address is contract or not as new version of openzeppeline remove isContract function from address.sol file
• Add rollOverReward function to use user reward to stake instead of giving reward in contract if user wants to use reward token to stake:
  • SSIP
  • SSRP
  • SyntheticSSIP
  • SyntheticSSRP

SSIP claim policy coverage splitting into different pools

Previously claim accessor manually split coverage amount into differents pools and request for policy to claim in different pools. After intergration of UMA, user have to manually split coverage amount into different pools and claim for policy in different pools

Contracts in scope (commit: 5a95f1f209638a3246bbfa49b6c964509395253a)

Type	File	Logic Contracts	Interfaces	Lines	nLines	nSLOC	Comment Lines	Complex. Score	Capabilities
📝	./contracts/EIP712MetaTransaction.sol	1	****	93	81	60	8	59	🖥💰🧮🔖
📝	./contracts/factories/SyntheticSSRPFactory.sol	1	****	15	15	11	1	17	🌀
📝	./contracts/factories/SalesPolicyFactory.sol	1	****	144	140	107	7	122	🌀
📝	./contracts/factories/RiskPoolFactory.sol	1	****	21	16	11	1	17	🌀
📝	./contracts/factories/RewarderFactory.sol	1	****	16	16	11	1	17	🌀
📝	./contracts/factories/SyntheticSSIPFactory.sol	1	****	15	15	11	1	17	🌀
📝	./contracts/RiskPoolERC20.sol	1	****	350	350	125	185	90	****
📝	./contracts/SingleSidedReinsurancePool.sol	1	****	385	377	301	18	300	🧮
📝	./contracts/libraries/EIP712Base.sol	1	****	49	49	34	8	23	🖥🧮
📚	./contracts/libraries/TransferHelper.sol	1	****	28	28	19	5	26	****
📝	./contracts/libraries/MultiSigWallet.sol	1	****	151	146	100	9	73	💰
📝	./contracts/ExchangeAgent.sol	1	****	268	242	207	7	183	💰
📝	./contracts/SingleSidedInsurancePool.sol	1	****	530	521	416	29	380	💰🧮
📝	./contracts/CapitalAgent.sol	1	****	309	303	253	1	226	****
📝	./contracts/uma/EscalationManager.sol	1	****	77	69	47	5	45	🧮
📝	./contracts/RiskPool.sol	1	****	222	222	192	10	177	💰
📝	./contracts/SyntheticSSIP.sol	1	****	262	262	206	9	168	****
📝🔍	./contracts/Rewarder.sol	1	1	131	124	103	1	111	💰
📝	./contracts/SyntheticSSRP.sol	1	****	262	262	206	9	168	****
📝	./contracts/SalesPolicy.sol	1	****	330	291	248	5	183	💰🧮🔖
📝	./contracts/PremiumPool.sol	1	****	272	265	230	7	229	🖥💰
📝📚🔍	Totals	21	1	3930	3794	2898	327	2628	🖥💰🧮🔖🌀🔆Σ

Contracts not for audit (commit: 5a95f1f209638a3246bbfa49b6c964509395253a)

Type	File	Logic Contracts	Interfaces	Lines	nLines	nSLOC	Comment Lines	Complex. Score	Capabilities
📚	./contracts/libraries/Counters.sol	1	****	25	25	10	14	1	🔆
📚	./contracts/libraries/AncillaryData.sol	1	****	143	131	65	55	41	Σ
	./contracts/uma/ClaimData.sol	****	****	4	4	2	1	****	****
📝📚🔍	Totals	2	0	172	160	77	70	45	🖥💰🧮🔖🌀🔆Σ

These are already audited smart contracts and we are keeping it out of scope of current audit.

ClaimData

• repository: https://github.com/UMAprotocol/protocol/blob/master/packages/core/contracts/optimistic-oracle-v3/implementation/ClaimData.sol

AncillaryData

• repository: https://github.com/UMAprotocol/protocol/blob/master/packages/core/contracts/common/implementation/AncillaryData.sol

Counters

• repository: https://github.com/utgarda/openzeppelin-solidity/blob/master/contracts/drafts/Counter.sol