Ondo Finance — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Ondo Finance, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 5
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 5 closed, publicly disclosed Ondo Finance reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, Oracle manipulation, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Ondo Finance
- Oracle manipulation findings disclosed against Ondo Finance
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Ondo Finance: The `BURNER` cannot burn tokens from accounts not KYC verified due to the check in `_beforeTokenTransfer`.
The Ondo Finance rOUSG contract contains a logical flaw where the authorized BURNER role is prevented from burning tokens held by accounts that lack current KYC verification. The _beforeTokenTransfer hook enforces a strict KYC check on the 'from' address, which blocks any transfer or burn operation initiated for a non-KYC-compliant user. This creates a functional denial-of-service for the burner, hindering the ability of the protocol to manage assets of non-verified accounts as intended.
Ondo Finance: Integration issue in `ousgInstantManager` with `BUIDL` if `minUSTokens` is set by blackrock
Ondo Finance's OUSGInstantManager is susceptible to unexpected reverts if BlackRock updates the minimum holding requirements for its BUIDL token. The current implementation does not account for these compliance constraints, meaning that if the mandatory holding floor is raised, the Ondo contract may be unable to redeem its assets as intended. This failure creates a denial-of-service condition for the instant redemption functionality, as the OUSGInstantManager is forced to maintain a specific balance that it may not be programmed to respect.
Ondo Finance: Users can lose access to funds due to minimum withdrawal limits
The InstantManager contract in the Ondo Finance protocol enforces a minimum withdrawal threshold of 50k USDC, which can lead to user funds being trapped. If a user withdraws a portion of their holdings such that the remaining balance is below this threshold, they lose the ability to withdraw the rest of their funds. To recover the stuck assets, a user is forced to deposit additional capital to exceed the minimum threshold, unnecessarily incurring more fees. This design choice creates a significant availability issue, preventing users from accessing their own capital held in the contract.
Ondo Finance: Inadequate handling of `BUIDL` redemption limit in `OUSG` instant manager
The OUSGInstantManager contract in the Ondo Finance protocol contains a logical flaw in its redemption mechanism that prevents users from redeeming their OUSG tokens when the contract's BUIDL balance is low, regardless of whether sufficient alternative liquidity (USDC) is available. Because the contract specifically checks its internal BUIDL balance during the redemption process, it unnecessarily denies requests that could otherwise be serviced by the combined pool of assets. This impacts the usability of the protocol's instant redemption feature, causing failed transactions for users when the manager's specific token allocation is depleted.
Ondo Finance: `OUSGInstantManager` will allow excessive `OUSG` token minting during `USDC` depeg event
The OUSGInstantManager contract contains a logic flaw where it assumes USDC is always worth exactly 1 USD during the minting of OUSG tokens. Because the protocol does not utilize a price oracle for the input collateral, it is susceptible to value extraction during periods when USDC depegs from its parity. An attacker can exploit this by minting OUSG tokens at an artificially low price compared to their actual value, depleting the protocol's treasury and undermining the collateralization of the OUSG token.