OnRe - mmbot

Quantstamp7 Apr 2026Code version: not recorded (see the report)

Audit

Quantstamp reviewed OnRe (OnRe - mmbot) on 7 Apr 2026: 3 findings, 0 critical; 2 marked fixed, 1 acknowledged.

No open critical findings

Open the report Open OnRe’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings3

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	1	2

Low`swap_orca` Does Not Allow Inclusion of Supplementary Tick Arrays, Meaning Valid Swaps May Sometimes FailFixed

The `swap_v2` implementation allows any `remaining_accounts_info` passed in the data to be included as supplementary tick arrays on top of the three default tick arrays provided. Requiring that the swap is executed within the three default tick arrays may mean some swaps that can be executed correctly may unexpectedly fail. The likelihood of this increases if the liquidity across ticks is shallow or if the size of the desired swap is large.

LowLack of Token Whitelist Allows Malicious `executor` to Extract Protocol FundsFixed

The architecture of the mmbot programs intends to limit the actions of the `executor` to making swaps between ONYC token and stablecoins (USDC and USDG). However, due to there being no validation on which tokens are swapped, a malicious `executor` would be able to trade the funds present in the protocol for any arbitrary tokens. This opens up a number of scenarios where theft of the protocol's funds is possible.