Ondo: GM Solana
Cantina reviewed Ondo Finance (Ondo: GM Solana) on 18 Dec 2025: 43 findings, 1 critical; all marked fixed.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings43
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 30 |
CriticalInfinite mint/redeem possible through signature manipulationFixed
The report gives no description here.
HighIncorrect rounding direction in mint_with_attestationFixed
The report gives no description here.
HighPrivilege escalation via lamport transfer to role PDA in whitelist operationsFixed
The report gives no description here.
HighToo low MIN_PRICE will lead to Ondo incurring significant losses in case of a USDC depegFixed
The report gives no description here.
HighUnchecked confidence value allows for usage of non trustworthy oracle pricesFixed
The report gives no description here.
MediumAdmin is not able to grant PAUSER_ROLE_GMTOKEN and UNPAUSER_ROLE_GMTOKEN roleFixed
The report gives no description here.
MediumAttestation/Token creation process can be blockedFixed
The report gives no description here.
MediumAttestations can't be closed in edge caseFixed
The report gives no description here.
MediumGM token pauser can also pause USDon due to shared mint authority and Pausable extensionFixed
The report gives no description here.
Mediuminitialize_user allows for rate limit bypassFixed
The report gives no description here.
Show 10 more
Mediumset_ondo_user_rate_limit uses wrong default windowFixed
The report gives no description here.
MediumUSDon UI multiplier can be modified by GM token UPDATE_MULTIPLIER_ROLEFixed
The report gives no description here.
MediumValue of action will be rounded down leading to bypass of limitFixed
The report gives no description here.
LowAdmin can't overwrite non-zero limit_windowFixed
The report gives no description here.
LowAttestation can be closed 30 seconds past creationFixed
The report gives no description here.
LowAttestation signer address is not validatedFixed
The report gives no description here.
LowAttestations can be reused by closing and recreating attestation PDAs before expirationFixed
The report gives no description here.
LowCreation of attestation PDA will not account for lamport balanceFixed
The report gives no description here.
LowDefined but unused error codes indicate missing or incomplete validationsFixed
The report gives no description here.
LowGM token admin mint cannot target PDA recipientsFixed
The report gives no description here.
Show 10 more
LowGM token minter bypasses token-level mint limitsFixed
The report gives no description here.
LowIncorrect mint used in swap_usdc_to_usdonFixed
The report gives no description here.
Lowinit_usdon_roles misses RoleGranted eventFixed
The report gives no description here.
Lowmint is missing token program checkFixed
The report gives no description here.
LowMinting/Redeeming can not be used with non-ATA token accountsFixed
The report gives no description here.
LowMissing mint capabilities for AdminMintRoleGmtokenManagerFixed
The report gives no description here.
LowMissing oracle-based swap pricing logic, swaps are always 1:1 despite oracle_price_enabledFixed
The report gives no description here.
LowNon ATA usdc_vault / usdon_vault will lead to all swaps revertingFixed
The report gives no description here.
Loworacle_price_max_age not checked against MAX_AGE_UPPER_BOUND on initializationFixed
The report gives no description here.
LowPyth oracle sanity check ignores price exponentFixed
The report gives no description here.
Show 10 more
LowRestriction on multisig usage as the upgrade authorityFixed
The report gives no description here.
LowSanity checker can be initialized with zero last_priceFixed
The report gives no description here.
LowSeveral defined roles are unused in the Solana programFixed
The report gives no description here.
LowSignature verification has more restrictions than intendedFixed
The report gives no description here.
Lowswap_usdon_to_usdc() allows for 0 value swapFixed
The report gives no description here.
LowType conversion can lead to unexpected behaviorFixed
The report gives no description here.
LowUSDC accounts don't verify correct token programFixed
The report gives no description here.
LowUSDC mint constraint is commented out in UsdcSwapContextFixed
The report gives no description here.
Lowusdc_price_update could be zeroFixed
The report gives no description here.
LowUSDon guardian cannot remove roles after giving themFixed
The report gives no description here.
Show 3 more
LowUSDon token minter/burner bypasses token-level mint limitsFixed
The report gives no description here.
LowUsers will loose up to 999 lamports of USDon on each USDC redemptionFixed
The report gives no description here.
LowZero usdon_mint can be intializedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Ondo Finance’s security record
Ondo FinanceSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us