Ondo Finance security record
As of 24 Oct 2026, Ondo Finance has 13 audit reports by 5 security firms on Trustblock; the latest is by Cantina, dated 17 Sep 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits13
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Ondo: rwa-internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo: RWA internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo PR 520 | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo: GM Solana | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · cantina.xyz |
| Ondo Finance | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Finance | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Bridge Registrar & USDon Converter | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo RWA Internal | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| RWA Security Review: Ondo Protocol Audit | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Ondo Finance security review | Security firm: Nethermind Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Ondo Protocol audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Ondo Finance V2 | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Ondo Protocol | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
Findings271
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 2 | 6 |
| Medium | 0 | 3 | 21 |
| Low | 0 | 129 | 108 |
Marked Gas Optimization, Informational, Best Practices or Info by the firms. Not counted as findings.
InformationalConsider using execution price instead of limit price for validation checkOndo: RWA internal · Cantina · 18 Jul 2026Acknowledged
The report gives no description here.
Open the reportInformationalLimitOrderLib::calculateQuoteAmount can round down to zero for small buy ordersOndo PR 520 · Cantina · 6 Feb 2026Acknowledged
The report gives no description here.
Open the reportInformationalPartial fills of buy orders can result in user losses due to the absence of refundsOndo PR 520 · Cantina · 6 Feb 2026Acknowledged
The report gives no description here.
Open the reportInformationalRole initializing/closing is dependent on mutability of programOndo: GM Solana · Cantina · 18 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalGetSValueBatch reverts on unknown assetOndo Finance · Cantina · 21 Nov 2025Acknowledged
The report gives no description here.
Open the reportInformationalPause flag is advisory onlyOndo Finance · Cantina · 21 Nov 2025Acknowledged
The report gives no description here.
Open the reportInformationalEdge Cases & Technical PrecautionsOndo RWA Internal · Cantina · 17 Jun 2025Acknowledged
The report gives no description here.
Open the reportInformationalConsider allowing current used capacity to be carried overRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Acknowledged
The report gives no description here.
Open the reportInformationaldefaultUserSubscriptionLimitConfigs is only applicable for new UsersRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Acknowledged
The report gives no description here.
Open the reportInformationalORACLE_SETTER_ROLE can change prices even on Freeze situationRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
Gas OptimizationRedundant InsufficientPsmUsdc checkRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Acknowledged
The report gives no description here.
Open the reportBest PracticesrenounceOwnership(...) function should be disabledOndo Finance security review · Nethermind Security · 24 Apr 2023Acknowledged
The report gives no description here.
Open the reportGas OptimizationCache storage reads into local variablesOndo: rwa-internal · Cantina · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalComment & Natspec ImprovementsOndo: rwa-internal · Cantina · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalInitialize issuer proxy with contract deploymentOndo: rwa-internal · Cantina · 17 Sep 2026Fixed
The report gives no description here.
Open the reportGas OptimizationRedundant conditional checkOndo: rwa-internal · Cantina · 17 Sep 2026Fixed
The report gives no description here.
Open the reportInformationalRedundant ImportOndo: rwa-internal · Cantina · 17 Sep 2026Fixed
The report gives no description here.
Open the reportGas OptimizationClamping is redundant due to cap on devBpsOndo: RWA internal · Cantina · 18 Jul 2026Fixed
The report gives no description here.
Open the reportInformationalMissing check for smaller quote quantity for exact quote buysOndo: RWA internal · Cantina · 18 Jul 2026Fixed
The report gives no description here.
Open the reportInformationalMissing sanity check in maxOrderDuration setterOndo: RWA internal · Cantina · 18 Jul 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalRedundant InvalidAddress error inputOndo: RWA internal · Cantina · 18 Jul 2026Fixed
The report gives no description here.
Open the reportInformationalIncorrect mocked quote typehashOndo PR 520 · Cantina · 6 Feb 2026Fixed
The report gives no description here.
Open the reportGas OptimizationReentrancyGuardTransient can be used to save gas on all nonReentrant callsOndo PR 520 · Cantina · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalcloser unnecessarily mutable in CloseAttestationAccountOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalIncorrect comment in sanity checkerOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalIncorrect documentation of GmTokenManagerAdminGlobalPauserOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalIncorrect documentation of MAX_SECONDS_EXPIRATIONOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalIncorrect documentation of mint_usdon and burn_usdonOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalIncorrect documentation of PauseGmTokenOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalIncorrect event emission in set_token_limitOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalIncorrect role comments for sanity checker in lib.rsOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalMetadata update authority set to program PDA but no update path implementedOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalMisleading is_paused parameter name for enable_oracle_priceOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalMissing access control documentation on initialize_usdon_manager functionOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalrate_limit_check should use PRICE_SCALING_FACTOROndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalTokens with transfer-allowed == false can still be transferredOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationaltrading_hours_offset missing in initialize_gmtoken_manager commentOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalUnnecessary role checks for AdminRoleGmtokenManagerOndo: GM Solana · Cantina · 18 Dec 2025Fixed
The report gives no description here.
Open the reportGas OptimizationCheaper conditional check for isOrderFullyFilled()Ondo Finance · Cantina · 6 Dec 2025Fixed
The report gives no description here.
Open the reportGas OptimizationexecutorUserId is checked per iteration for batch callsOndo Finance · Cantina · 6 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
Gas Optimizationmsg.sender emission in OrderCancelled is redundantOndo Finance · Cantina · 6 Dec 2025Fixed
The report gives no description here.
Open the reportGas OptimizationRedundant condition checked in isOrderActive()Ondo Finance · Cantina · 6 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalUser may be removed from registry between order creation and executionOndo Finance · Cantina · 6 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalSetter path cannot be frozen via paramsOndo Finance · Cantina · 21 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalUnused custom errorOndo Finance · Cantina · 21 Nov 2025Fixed
The report gives no description here.
Open the reportInformationalExcessive oracle staleness thresholdOndo Bridge Registrar & USDon Converter · Cantina · 9 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalMissing natSpec documentation for constructor parameterOndo Bridge Registrar & USDon Converter · Cantina · 9 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalMissing oracle decimal validationOndo Bridge Registrar & USDon Converter · Cantina · 9 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalMissing zero address validation for guardianOndo Bridge Registrar & USDon Converter · Cantina · 9 Oct 2025Fixed
The report gives no description here.
Open the reportInformationalUse encode instead of encodePacked for tokenId generationOndo Bridge Registrar & USDon Converter · Cantina · 9 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalTypos, Minor Recommendations, RedundanciesOndo RWA Internal · Cantina · 17 Jun 2025Fixed
The report gives no description here.
Open the reportInformationalUnrestricted minting without Rate limit allowed for ADMIN_MINT_ROLEOndo RWA Internal · Cantina · 17 Jun 2025Fixed
The report gives no description here.
Open the reportInformationalADMIN_SUBSCRIPTION_ROLE can mint during pauseRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalComment and Variable ImprovementsRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportGas OptimizationcurrentPrice can be directly assigned to priceStoredRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalEnforce both minimumTokenPrice and oracle are setRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalFEE_PRECISION is of inconsistent precisionRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportGas OptimizationFirst conditional volume check can include equality caseRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalFrontrunning can be used to disallow Fee Manager operationsRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalMax cap can be set on feeConfig.bpsFeeRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalMissing interface inheritance of PauseManagerRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportGas OptimizationRedundant allowance checksRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportGas OptimizationRedundant decrement in SusdsSource.availableToWithdraw()RWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportGas OptimizationRedundant uint48 casting of windowRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportGas OptimizationRedundant USD_NORMALIZER normalizationRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalwithdrawToken call should be skipped for 0 token withdrawalsRWA Security Review: Ondo Protocol Audit · Cantina · 27 Mar 2025Fixed
The report gives no description here.
Open the reportInfoEvents in RWA oracles differOndo Finance security review · Nethermind Security · 24 Apr 2023Fixed
The report gives no description here.
Open the reportInfoInconsistent behavior on price == 0Ondo Finance security review · Nethermind Security · 24 Apr 2023Fixed
The report gives no description here.
Open the reportInfoIncorrect check for decimalsOndo Finance security review · Nethermind Security · 24 Apr 2023Fixed
The report gives no description here.
Open the reportInfoNo check for fToken validityOndo Finance security review · Nethermind Security · 24 Apr 2023Fixed
The report gives no description here.
Open the reportShow 1 more
Best PracticesUse of magic numbersOndo Finance security review · Nethermind Security · 24 Apr 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="ondo-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us