Ondo Finance security record
As of 24 Oct 2026, Ondo Finance has 13 audit reports by 5 security firms on Trustblock; the latest is by Cantina, dated 17 Sep 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits13
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Ondo: rwa-internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo: RWA internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo PR 520 | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo: GM Solana | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · cantina.xyz |
| Ondo Finance | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Finance | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Bridge Registrar & USDon Converter | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo RWA Internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| RWA Security Review: Ondo Protocol Audit | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Finance security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Ondo Protocol audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Ondo Finance V2 | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Ondo Protocol | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
Findings271
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 2 | 6 |
| Medium | 0 | 3 | 21 |
| Low | 0 | 129 | 108 |
CriticalInfinite mint/redeem possible through signature manipulationOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportCriticalFlaw in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportHighIncorrect rounding direction in mint_with_attestationOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportHighPrivilege escalation via lamport transfer to role PDA in whitelist operationsOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportHighToo low MIN_PRICE will lead to Ondo incurring significant losses in case of a USDC depegOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportHighUnchecked confidence value allows for usage of non trustworthy oracle pricesOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportHighDocumentation in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportHighFlaw in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportMediumAdmin is not able to grant PAUSER_ROLE_GMTOKEN and UNPAUSER_ROLE_GMTOKEN roleOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportMediumAttestation/Token creation process can be blockedOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumAttestations can't be closed in edge caseOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportMediumGM token pauser can also pause USDon due to shared mint authority and Pausable extensionOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportMediuminitialize_user allows for rate limit bypassOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportMediumset_ondo_user_rate_limit uses wrong default windowOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportMediumUSDon UI multiplier can be modified by GM token UPDATE_MULTIPLIER_ROLEOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportMediumValue of action will be rounded down leading to bypass of limitOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportMediumOFT cannot burn tokens during cross-chain transfers due to missing BURNER_ROLEOndo Bridge Registrar & USDon Converter · Cantina · 9 Oct 2025Fixed
The report gives no description here.
Open the reportMediumGMToken isn't redeemable due to lacking burn(uint256 amount) functionOndo RWA Internal · Cantina · 17 Jun 2025Fixed
The report gives no description here.
Open the reportMediumQUOTE_TYPEHASH is incorrectly definedOndo RWA Internal · Cantina · 17 Jun 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect condition would cause DoS on subscription and redemptionRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumFlaw in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportMediumFlaw in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportMediumFlaw in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportMediumFlaw in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportMediumFlaw in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportMediumSuboptimal in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportMediumSuboptimal in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportMediumPossible Incorrect Path Reward UpdateOndo Finance V2 · Quantstamp · 13 Sep 2021Fixed
`updateRewardPath` requirement in [L282](https://github.com/ondoprotocol/protocol-dev/blob/610a6291951bb12b2cf9dbbd8ff31faeb2e22d11/contracts/strategies/SushiStakingV2Strategy.sol#L282) seems incorrect since in the case if reward token and end token are similar the required length is set to be higher than 1, meaning that resetting a path length equal to 1 is not allowed.
Open the reportMediumPossible Truncation While Calculating Vault Deposits SharesOndo Finance V2 · Quantstamp · 13 Sep 2021Fixed
The implemented staking mechanism in `SushiStakingV2Strategy` is highly optimized and helps avoid any extra computation. However, setting the values of the initial shares for a specific pool is important and should be analyzed carefully. The algorithm is designed in a way to compute smaller shares every time that the LP rewards get higher, meaning that depositing the same LP tokens values for a specific vault will result in giving different shares values (while the reward is accruing). However, if the initial deposit is low enough and if the LP rewards are significantly greater than the initial LP deposit, new deposits to the vault will see their computed share being truncated. In a worst-case scenario, if for any reason higher LP rewards can be introduced by an attacker, the next deposits will be truncated following the value of rewards introduced. The attacker will profit by getting higher returns.
Open the reportLowPrecision loss due to sequential divisions in calculateQuoteAmount() can undercharge BUY ordersOndo PR 520 · Cantina · 6 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowAdmin can't overwrite non-zero limit_windowOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowAttestation can be closed 30 seconds past creationOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowAttestation signer address is not validatedOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowAttestations can be reused by closing and recreating attestation PDAs before expirationOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowCreation of attestation PDA will not account for lamport balanceOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowDefined but unused error codes indicate missing or incomplete validationsOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowGM token admin mint cannot target PDA recipientsOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowGM token minter bypasses token-level mint limitsOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowIncorrect mint used in swap_usdc_to_usdonOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowinit_usdon_roles misses RoleGranted eventOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
Lowmint is missing token program checkOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowMinting/Redeeming can not be used with non-ATA token accountsOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowMissing mint capabilities for AdminMintRoleGmtokenManagerOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowMissing oracle-based swap pricing logic, swaps are always 1:1 despite oracle_price_enabledOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowNon ATA usdc_vault / usdon_vault will lead to all swaps revertingOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLoworacle_price_max_age not checked against MAX_AGE_UPPER_BOUND on initializationOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowPyth oracle sanity check ignores price exponentOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowRestriction on multisig usage as the upgrade authorityOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowSanity checker can be initialized with zero last_priceOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowSeveral defined roles are unused in the Solana programOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowSignature verification has more restrictions than intendedOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowswap_usdon_to_usdc() allows for 0 value swapOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowType conversion can lead to unexpected behaviorOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowUSDC accounts don't verify correct token programOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowUSDC mint constraint is commented out in UsdcSwapContextOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowusdc_price_update could be zeroOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowUSDon guardian cannot remove roles after giving themOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowUSDon token minter/burner bypasses token-level mint limitsOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowUsers will loose up to 999 lamports of USDon on each USDC redemptionOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportLowZero usdon_mint can be intializedOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowHardcoded conversion rate breaks converter functionality on chains with 18-decimal USDCOndo Bridge Registrar & USDon Converter · Cantina · 9 Oct 2025Fixed
The report gives no description here.
Open the reportLowInconsistent gmIdentifier definitionOndo RWA Internal · Cantina · 17 Jun 2025Fixed
The report gives no description here.
Open the reportLowMissing onUSD refund on mintsOndo RWA Internal · Cantina · 17 Jun 2025Fixed
The report gives no description here.
Open the reportLowavailableToWithdraw does not check paused stateRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportLowBuidlUSDCSource can have fewer BUIDL tokens than the minimum redeem criteriaRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportLowPrecision loss in rOUSG share calculation allows subscriptions to exceed slippage toleranceRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportLowPSMSource.sol:availableToWithdraw does not check available USDS liquidityRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportLowUnconditional rounding up pulls in 1 wei more for divisible USDS amountsRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportLowChanging oracle type does not remove previous oracle dataOndo Finance security review · Nethermind Security · 24 Apr 2023Fixed
The report gives no description here.
Open the reportLowLack of a two-step process for transferring ownershipOndo Finance security review · Nethermind Security · 24 Apr 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowBad datatype in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowBad naming in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IBalancerVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IBalancerVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowDocumentation in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IRegistry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in IStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in ITrancheToken.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowDocumentation in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowFlaw in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowFlaw in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowFlaw in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowOverflow/Underflow in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowOverflow/Underflow in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowOverflow/Underflow in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowOverflow/Underflow in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowOverflow/Underflow in SAStrategyConvex.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowOverflow/Underflow in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowProcedural in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in ICurve_2.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in IPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in IRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in IStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in OndoLibrary.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowProcedural in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowReadability in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in AConvexAutocompounder.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in BalancerStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in ConvexAutocompounderStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in IRegistry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in ISAStrategy.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in SAStrategyAllPairVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in SAStrategyRollover.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowSuboptimal in SingleAssetVault.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportShow 7 more
LowUnclear behavior in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLowUnclear behavior in Registry.solOndo Protocol audit · ABDK Consulting · 26 Oct 2022Fixed
The report gives no description here.
Open the reportLow`updateRewardPath` Allows Circular PathsOndo Finance V2 · Quantstamp · 13 Sep 2021Fixed
The `SushiStakingV2Strategy.updateRewardPath(...)` function allows paths with lengths greater than one, yet, with the reward and end token being the same (circular). It is just wasteful to trade a token for itself. At the code level (L278--281), this appears as follows: ``` L278. require( L279. rewardToken != endToken || _pathFromReward.length > 1, <=== L280. "Invalid path" ); ``` For `_pathFromReward.length > 1` to be evaluated, `rewardToken` must be the same as `endToken`, in which case the length is already greater than one. Otherwise, if `rewardToken == endToken`, the length should be exactly one, which is not the condition being checked.
Open the reportLowClone and Own (1)Ondo Finance V2 · Quantstamp · 13 Sep 2021Fixed
Function `calculateSwapInAmount(...)` appears to have been cloned from Alpha Homora and Zapper, but the inline code comment does not indicate the commit hash and file from which it was taken. If buggy, faulty behavior may be permanently set in unless one is able to trace the code and corresponding fixes that might surface.
Open the reportLowHarvest Is Not Affected by PausingOndo Finance V2 · Quantstamp · 13 Sep 2021Fixed
To allow reacting to a potential hack, it is always a good practice to allow pausing a contract. However, `SushiStakingV2Strategy.harvest(...)` can still be called when the contract is paused. Note that the latter calls `_compound`, which is itself not affected by any pauses. Hence, one can invoke `harvest(...)` while the strategy is paused. That should not be allowed, especially in the case of reacting to a hack.
Open the reportLowLp Removal Does Not Validate Target AddressOndo Finance V2 · Quantstamp · 13 Sep 2021Fixed
The `SushiStakingV2Strategy.removeLp(...)` does not validate its `to` argument. If `address(0)`, the removal essentially burn funds.
Open the reportLowVault Shares Update Does Not Follow the Same PatternOndo Finance V2 · Quantstamp · 13 Sep 2021Fixed
`depositIntoChef()` does not accumulate the vault shares but rewrites them, using the input value. This scheme is not used any of the other functions that update the shares. Even if `depositIntoChef` can be called only once, developers should be careful with future contract updates.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="ondo-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us