Ondo: GM Solana
Cantina reviewed Ondo Finance (Ondo: GM Solana) on 18 Dec 2025: 43 findings, 1 critical; all marked fixed.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings43
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 30 |
Marked Informational by the firm. Not counted as findings.
InformationalRole initializing/closing is dependent on mutability of programAcknowledged
The report gives no description here.
Informationalcloser unnecessarily mutable in CloseAttestationAccountFixed
The report gives no description here.
InformationalIncorrect comment in sanity checkerFixed
The report gives no description here.
InformationalIncorrect documentation of GmTokenManagerAdminGlobalPauserFixed
The report gives no description here.
InformationalIncorrect documentation of MAX_SECONDS_EXPIRATIONFixed
The report gives no description here.
InformationalIncorrect documentation of mint_usdon and burn_usdonFixed
The report gives no description here.
InformationalIncorrect documentation of PauseGmTokenFixed
The report gives no description here.
InformationalIncorrect event emission in set_token_limitFixed
The report gives no description here.
InformationalIncorrect role comments for sanity checker in lib.rsFixed
The report gives no description here.
InformationalMetadata update authority set to program PDA but no update path implementedFixed
The report gives no description here.
Show 6 more
InformationalMisleading is_paused parameter name for enable_oracle_priceFixed
The report gives no description here.
InformationalMissing access control documentation on initialize_usdon_manager functionFixed
The report gives no description here.
Informationalrate_limit_check should use PRICE_SCALING_FACTORFixed
The report gives no description here.
InformationalTokens with transfer-allowed == false can still be transferredFixed
The report gives no description here.
Informationaltrading_hours_offset missing in initialize_gmtoken_manager commentFixed
The report gives no description here.
InformationalUnnecessary role checks for AdminRoleGmtokenManagerFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Ondo Finance’s security record
Ondo FinanceSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us