Ondo Finance security record
As of 24 Oct 2026, Ondo Finance has 13 audit reports by 5 security firms on Trustblock; the latest is by Cantina, dated 17 Sep 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits13
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Ondo: rwa-internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo: RWA internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo PR 520 | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo: GM Solana | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · cantina.xyz |
| Ondo Finance | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Finance | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Bridge Registrar & USDon Converter | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo RWA Internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| RWA Security Review: Ondo Protocol Audit | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Finance security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Ondo Protocol audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Ondo Finance V2 | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Ondo Protocol | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
Findings271
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 2 | 6 |
| Medium | 0 | 3 | 21 |
| Low | 0 | 129 | 108 |
HighFlaw in OndoRegistryClientInitializable.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportHighSuboptimal in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportMediumRounding issue when calculating absolute changes in basis points (BPS)Ondo Finance security review · Nethermind Security · 24 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumMid-Term Lp Deposits Allow For Relative Risk-Free ProfitsOndo Finance V2 · Quantstamp · 13 Sep 2021Acknowledged
An attacker can sandwich-attack every time `SushiStakingV2Strategy.harvest(...)` is called by mid-term depositing LP tokens before the harvest (receiving tranche tokens). The attacker proceeds to withdraw the tranche share tokens for an increased amount of LP tokens.
Open the reportMediumUse of Magic Numbers Dependent on External Protocol FeesOndo Finance V2 · Quantstamp · 13 Sep 2021Acknowledged
The constants used in the `calculateSwapInAmount()` function depend on the fees charged by Uniswap and SushiSwap. Changes in fees by these protocols would lead to incorrect calculations.
Open the reportLowBatch execution of limit orders can be DOS'edOndo PR 520 · Cantina · 6 Feb 2026Acknowledged
The report gives no description here.
Open the reportLowContract deviations from Notion specOndo Finance · Cantina · 21 Nov 2025Acknowledged
The report gives no description here.
Open the reportLowPrecision loss in USDon to USDC redemptionOndo Bridge Registrar & USDon Converter · Cantina · 9 Oct 2025Acknowledged
The report gives no description here.
Open the reportLowSetting limits should revive capacityUsed accordinglyRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Acknowledged
The report gives no description here.
Open the reportLow_setFTokenToChainlinkOracle(...) does not check oracle decimalsOndo Finance security review · Nethermind Security · 24 Apr 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowUse AccessControlDefaultAdminRulesOndo Finance security review · Nethermind Security · 24 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in BasePairLPStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in ISingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in OndoRegistryClient.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in OndoRegistryClientInitializable.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in OndoRegistryClientInitializable.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad datatype in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad naming in BasePairLPStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad naming in IRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad naming in IStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowBad naming in IWETH.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad naming in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in IBaseRewardPool.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in IConvexBooster.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in IConvexBooster.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in ICurve_2.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in ICurve_3.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in ISAStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowDocumentation in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowDocumentation in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowOverflow/Underflow in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in BasePairLPStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in ICurve_3.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in IMultiex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowProcedural in Multiex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowProcedural in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowReadability in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in BasePairLPStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in IRegistry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in IRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in IStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoRegistryClientInitializable.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoRegistryClientInitializable.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in OndoRegistryClientInitializable.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in OndoRegistryClientInitializable.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in ICurve_2.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in ICurve_3.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Acknowledged
The report gives no description here.
Open the reportLowClone and Own (2)Ondo Finance V2 · Quantstamp · 13 Sep 2021Acknowledged
Contract `SushiStakingV2Strategy` shares a lot of commonality with `SushiStrategyLP`, but duplicated code appears in both contracts. Not only this adds extra maintenance, but also can lead to incorrect bug fixing if fixes are done in one strategy, but not the other.
Open the reportLowIncorrect Path Validation LogicOndo Finance V2 · Quantstamp · 13 Sep 2021Acknowledged
The`rewardPaths` array should have two paths. It seems one path should end in `token0` and the other in `token1` (or vice-versa). However, the implementation in `SushiStakingV2Strategy.addPool(...)`, both paths could end in `token0` or `token1`. It is unclear if the latter situation is indeed desired; our understanding is that **only** the first case should be allowed.
Open the reportShow 4 more
LowMising `isContract` ValidationOndo Finance V2 · Quantstamp · 13 Sep 2021Acknowledged
The constructor of `SushiStakingV2Strategy` does not validate whether the input addresses are indeed contracts; same with `SushiStakingV2Strategy.addPool(...)` and `AlchemixUserReward.constructor(...)`. Hence, incorrect setups could lead the contract to misbehave.
Open the reportLowPossible Transaction Revert Due to Sandwich AttackOndo Finance V2 · Quantstamp · 13 Sep 2021Acknowledged
Not including the minimum out values and setting its value to zero when executing an external call to Sushiswap might result in a failing transaction due to bots not recognizing that a transaction may fail later on. This issue depends on how the attack bots are implemented.
Open the reportLowPotential Division by an Extremely Small ValueOndo Finance V2 · Quantstamp · 13 Sep 2021Acknowledged
The `SushiStakingV2Strategy.depositIntoChef(...)` calls `_compound()` before reaching the block in L497-500, in which the following calculation s performed: ``` uint256 shares = (_amount * poolData.totalShares) / poolData.totalLp ``` If `poolData.totalLp` is an extremely small value (for example, because of some dust generated from calling `_compound()`), this may lead to an extremely large value being stored in the `shares` variable. A similar issue is present in `withdrawFromChef(...)`.
Open the reportLowPrivileged Roles and OwnershipOndo Finance V2 · Quantstamp · 13 Sep 2021Acknowledged
Many operations in `SushiStakingV2Strategy` rely on a strategist role. A vault's strategist is responsible for correctly executing most of the vault and strategy actions and needs to be trusted. Even when assuming full trust in strategists, `SushiStakingV2Strategy` would be at risk if strategists get compromised.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="ondo-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us