ECOMI

Scope Definition and Security Guarantees: The audit source-file scope is limited to contracts/OMIStaking_v5.sol (OMIStaking). Other repository Solidity includes the testnet mirror OMIStakingTest, OMIEmberMonthTest, OMIPassTest, TestOMI, MockBlacklistOMI, OMIStakingTestLegacyV6, _OZImports.sol, and Foundry mocks, handlers, and invariant tests. Comments in OMIStaking defer TimelockController and multisig wiring to out-of-scope deploy scripts such as contracts-deploy/scripts/deployMainnet.cjs. Defects or mis-wiring in those out-of-scope artifacts can still determine who owner and pauser are and how upgrades are scheduled, without being covered by this review.

System Reliance on External Contracts: Every value-moving path in OMIStaking depends on the immutable ERC-20 at OMI_TOKEN (0x3792DBDD07e87413247DF995e692806aa13D3299). stake and topUp pull with safeTransferFrom; withdraw, earlyWithdraw, _forwardPenalty, recoverTokens, and sweepStuckPenalties push with safeTransfer; _omiSurplus reads balanceOf. Comments require that token to behave as a standard, non-fee, non-rebasing, non-denylisting ERC-20 (named as OptimismMintableERC20). A revert or denylist on that token can block stake and topUp and, because the user payout in withdraw and earlyWithdraw is not inside try/catch, can also block the always-exit path.

External Precompile or Infrastructure Dependency: OMIStaking is documented for Base L2, where comments state that true OMI burns are unavailable. penaltyAddress is described as routing early-exit OMI to a bridge or custodian for an L1 burn. earlyWithdraw forwards the penalty through _forwardPenalty; if that destination reverts, the user still forfeits (total * earlyWithdrawPenaltyBps) / BPS_DENOMINATOR and the tokens are added to stuckPenalties until sweepStuckPenalties. Penalty-burn completion and general liveness therefore depend on Base infrastructure and on the off-contract penalty destination, neither of which this implementation controls.

Coarse-Grained Authorization Model: A single owner (inherited from Ownable2StepUpgradeable) gates setPenaltyAddress, setEarlyWithdrawPenaltyBps, setPauser, addTier, removeTier, recoverTokens, sweepStuckPenalties, _authorizeUpgrade, and transferOwnership on OMIStaking. pause and unpause are split to onlyPauser, but that pauser address is assigned by the same owner via setPauser. Compromise of owner therefore covers economic parameters, rescue of surplus and stuck penalties, pauser rotation, and replacement of UUPS logic in one role.

Absence of on-chain timelock and multi-signature controls: OMIStaking gates configuration and upgrades with onlyOwner and onlyPauser and encodes no delay, schedule, confirmation count, or signature threshold. Comments describe owner as an OpenZeppelin TimelockController with a 48-hour delay and a multisig as timelock proposer, canceller, executor, and live pauser, yet they also state that the source guarantees nothing about role assignment. initialize stores _owner and _pauser as ordinary addresses, and setEarlyWithdrawPenaltyBps, setPenaltyAddress, addTier, removeTier, setPauser, recoverTokens, sweepStuckPenalties, and _authorizeUpgrade take effect as soon as the owner call succeeds. If owner is a single account, that account can raise the early-exit cost to 20%, retarget penaltyAddress, and replace UUPS logic in one transaction, while pause and unpause already execute immediately for pauser or owner.

Treasury or Rescue Authority: recoverTokens (onlyOwner, nonReentrant) transfers an ERC-20 to a caller-chosen destination. When token OMI_TOKEN, amount must be less than or equal to _omiSurplus (balance minus totalStakedOMI minus stuckPenalties); for any other token, the requested amount is transferred with no surplus cap, and safeTransfer reverts if the balance is insufficient. sweepStuckPenalties sets stuckPenalties to zero and transfers that OMI to any non-zero destination, not necessarily penaltyAddress. Under this implementation those paths cannot reduce the staked principal floor, but they do let the owner extract surplus OMI, foreign tokens, and failed-forward penalties once onlyOwner is satisfied.

Single Points of Failure and Control: Operational control of OMIStaking concentrates on owner and pauser. Via onlyPauser, pauser or owner can pause and halt stake, topUp, restake, and extendLockPeriod; withdraw and earlyWithdraw remain callable, and pauser has no token-transfer function. The owner additionally changes penalty parameters, rotates pauser, recovers surplus, sweeps stuckPenalties, and authorizes UUPS upgrades. Custody of those two addresses cannot be verified from this contract; owner compromise plus _authorizeUpgrade is the path that can rewrite accounting and move principal, while pauser compromise can freeze new entries and lock extensions only.

Centralized Governance Mechanisms: The registered tier set, earlyWithdrawPenaltyBps, penaltyAddress, and pauser are not voted by OMI holders. They are written by owner through addTier, removeTier, setEarlyWithdrawPenaltyBps, setPenaltyAddress, and setPauser. Holders of active StakePosition entries have no on-chain veto other than earlyWithdraw at the then-current penalty or waiting until unlockTime for withdraw.

Flexibility and Risk in Contract Upgrades: OMIStaking inherits UUPSUpgradeable and authorizes implementation changes only in _authorizeUpgrade. Comments state that UUPS is the sole admin path that can reach user principal, because recoverTokens is bounded by _omiSurplus. A replacement implementation can alter stakes, totalStakedOMI, or token transfers and extract locked OMI.

Incompatibility with Pending State During Upgrade: Each wallet may hold a live StakePosition (amount, tierDuration, startTime, unlockTime, lastTopUpTime) whose OMI remains in the contract until withdraw or earlyWithdraw. Locks can last up to MAX_TIER_DURATION (720 days). An upgrade that reorders that struct, removes those exit functions, or changes how totalStakedOMI is interpreted can leave in-flight positions unable to exit under the new logic.

Lack of Emergency Downgrade Mechanism: OMIStaking has no rollback, implementation snapshot, or previous-version registry. Recovering from a faulty upgrade requires another onlyOwner UUPS upgrade to prior bytecode. If the broken implementation disables _authorizeUpgrade or bricks owner, that recovery path is unavailable from this contract.'

Off-chain XP accounting and UI-owned floors: OMIStaking distributes no on-chain rewards; comments state that an off-chain XP engine consumes Staked, ToppedUp, Withdrawn, Restaked, and LockExtended, and must classify exits by Withdrawn.earlyExit rather than penaltyAmount. stake and topUp require only amount > 0, so business floors and top-up pacing described as UI-owned are bypassable by a direct call, and dust stakes can enter totalStakedOMI with no on-chain qualifying threshold. removeTier leaves existing positions with a stored tierDuration that may be absent from getValidTiers. Engine downtime or mis-parsing does not trap OMI, but it can mis-allocate off-chain XP.

L2 penalty transfer is not an L1 burn: Early-exit value is not burned inside OMIStaking. earlyWithdraw transfers the penalty to penaltyAddress via _forwardPenalty, and comments describe that address as a bridge or custodian path for an L1 burn of Base OptimismMintableERC20 OMI. This contract does not verify a burn, a burn amount, or that penaltyAddress is a bridge. Divergence between L2 penalty receipts and any L1 supply reduction cannot be detected or reconciled by OMIStaking.

Requested-amount escrow versus live token balances: stake and topUp add the caller-supplied amount to stakes[msg.sender].amount and totalStakedOMI before safeTransferFrom of that same figure, not a measured balance delta. _omiSurplus compares IERC20(OMI_TOKEN).balanceOf(address(this)) to totalStakedOMI + stuckPenalties. Comments require OMI to have no fee-on-transfer and no rebase, and they state that OMI_TOKEN must not be repointed in a future upgrade without reworking accounting. A token that violated those assumptions would desync the solvency floor from redeemable OMI.