OnGO security record
As of 3 Nov 2026, OnGO has 1 audit report on Trustblock, by CertiK, dated 27 Dec 2022. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
Findings13
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 0 | 11 |
LowAmount Check Before Reward UpdateOngo · CertiK · 27 Dec 2022Fixed
In the function `stakeReward`, the stake `_amount` check is before the calling of the function `_updateStakeholderReward(msg.sender)`. The user may have unsettled rewards and can only stake part of the `totalReward`.
Open the reportLowDurations should be checked in function `launchNeOngo · CertiK · 27 Dec 2022Fixed
In the function `launchNextPhase()`, it does not require that the durations of each stage have already been set to launch the registration phase from setup. If these durations are still default values, there is no deadline for the stage.
Open the reportLowFunctions for testing purposeOngo · CertiK · 27 Dec 2022Fixed
The function `updateMaxNbTokensPerPartAtPP()` can be called by anyone as it has no access restriction. It is for testing purpose and should be removed in the deployment version.
Open the reportLowIncreasing order does not include RUBY typeOngo · CertiK · 27 Dec 2022Fixed
The function `setTiersTokensAllocationFactors()` does not require sapphire factor greater than ruby factor.
Open the reportLowPotential Out-of-Gas ExceptionOngo · CertiK · 27 Dec 2022Fixed
The function `adjustRewardRatePer1TFTG()` has to update rewards for all users, which may lead to an out-of-gas error.
Open the reportLowRedundant codeOngo · CertiK · 27 Dec 2022Fixed
The difference between the case `_lockDuration == 0` and `_lockDuration >= 30 days` is that the condition `_lockDuration >= 30 days` should increase `stakeholders[msg.sender].totalLockedBalance`.
Open the reportLowUnchecked Value of ERC-20 `transfer()`/`transferFOngo · CertiK · 27 Dec 2022Fixed
The linked `transfer()`/`transferFrom()` invocations do not check the return value of the function call, which should yield `true` in the case of a proper ERC-20 implementation.
Open the reportLowUnknown Imported Source FileOngo · CertiK · 27 Dec 2022Fixed
The imported source files - `import "OpenZeppelin/openzeppelin-contracts@4.1.0/contracts/token/ERC20/IERC20.sol";` - `import "paulrberg/prb-math@2.5.0/contracts/PRBMath.sol";` - `import "OpenZeppelin/openzeppelin-contracts@4.1.0/contracts/access/Ownable.sol";` are not existing in the current scope of the audit codebase.
Open the reportLowUnsafe Type ConversionOngo · CertiK · 27 Dec 2022Fixed
The linked statements cast between type `uint256` and `int256` without evaluating the bounds. If the most significant bit is 1, the casting result will be deducted by the Two's complement which may be not a correct result.
Open the reportLowUser-Defined GettersOngo · CertiK · 27 Dec 2022Fixed
The linked functions are equivalent to the compiler-generated getter functions for the respective variables.
Open the reportShow 1 more
LowVariables That Could Be Declared as ImmutableOngo · CertiK · 27 Dec 2022Fixed
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="ongo"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us