RWA Security Review: Ondo Protocol Audit
Cantina reviewed Ondo Finance (RWA Security Review: Ondo Protocol Audit) on 27 Mar 2025: 7 findings, 0 critical; 6 marked fixed, 1 acknowledged.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings7
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 1 | 5 |
Marked Informational or Gas Optimization by the firm. Not counted as findings.
InformationalConsider allowing current used capacity to be carried overAcknowledged
The report gives no description here.
InformationaldefaultUserSubscriptionLimitConfigs is only applicable for new UsersAcknowledged
The report gives no description here.
InformationalORACLE_SETTER_ROLE can change prices even on Freeze situationAcknowledged
The report gives no description here.
Gas OptimizationRedundant InsufficientPsmUsdc checkAcknowledged
The report gives no description here.
InformationalADMIN_SUBSCRIPTION_ROLE can mint during pauseFixed
The report gives no description here.
InformationalComment and Variable ImprovementsFixed
The report gives no description here.
Gas OptimizationcurrentPrice can be directly assigned to priceStoredFixed
The report gives no description here.
InformationalEnforce both minimumTokenPrice and oracle are setFixed
The report gives no description here.
InformationalFEE_PRECISION is of inconsistent precisionFixed
The report gives no description here.
Gas OptimizationFirst conditional volume check can include equality caseFixed
The report gives no description here.
Show 8 more
InformationalFrontrunning can be used to disallow Fee Manager operationsFixed
The report gives no description here.
InformationalMax cap can be set on feeConfig.bpsFeeFixed
The report gives no description here.
InformationalMissing interface inheritance of PauseManagerFixed
The report gives no description here.
Gas OptimizationRedundant allowance checksFixed
The report gives no description here.
Gas OptimizationRedundant decrement in SusdsSource.availableToWithdraw()Fixed
The report gives no description here.
Gas OptimizationRedundant uint48 casting of windowFixed
The report gives no description here.
Gas OptimizationRedundant USD_NORMALIZER normalizationFixed
The report gives no description here.
InformationalwithdrawToken call should be skipped for 0 token withdrawalsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Ondo Finance’s security record
Ondo FinanceSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us