Under active development. We're continuously fixing and improving the metrics and parameters, so scores and ratings may change. See changelog

RWABeat

Ondo Short-Term US Government Treasuries

Tokenized LP interest in a Delaware fund of tokenized Treasury and money-market funds (State Street SWEEP, BlackRock BUIDL, Franklin BENJI, Fidelity FYOXX) plus USDC. Eligible holders can mint and redeem against USDC instantly, 24/7.

U.S. TreasuriesQualified purchasers onlyTransfer-restrictedIssued by Ondo Capital Management LLC · Platform Ondo Finance
Value
$135.1M
Stage
None
Below Stage 0: key facts not disclosed
Single-key powers
0
None critical · can freeze, pause
Oracle age
19m
On schedule
Used as DeFi collateral
$0· 0 markets

Control

Who can freeze, mint, pause or upgrade, and what stops them?

Red

A single key can freeze a holder's tokens.

  1. A single key can freeze a holder's tokens.

  2. Multisig signers aren't named, so their independence can't be checked.

  3. A 4-of-7 multisig can replace the contract code with no timelock.

  4. A 3-of-5 multisig can create new tokens with no timelock.

  5. A 2-of-6 multisig can change the onchain price: few signers need to agree.

  6. A 3-of-5 multisig can change the onchain price with no timelock.

  7. A 3-of-5 multisig can move the assets backing the token with no timelock.

  8. A 3-of-5 multisig can grant or revoke every other role with no timelock.

  9. A single key can pause all transfers.

  10. The issuer doesn't document its admin powers; they're only visible onchain.

  11. Audited by Spearbit (2025-03).

  • Bug bounty on Immunefi, up to $1,000,000.
  • Transfers are limited to allowlisted wallets.

Audits and bug bounty

  • Spearbit · Ondo Funds and USDY (Ethereum)1 Mar 2025

Bug bounty on Immunefi, up to $1,000,000.

Chains and bridges

Holders on a bridged chain also depend on the bridge.

  • ethereum, polygon, solana, xrplIssued natively · Ondo

Who controls OUSG on Ethereum

Token and service contracts on the left, the accounts holding their powers on the right. Edge color is the risk status of that power.

Powers

Every privileged power we found, normalized to canonical power types.

  • UpgradeCriticalYellow
    ProxyAdmin0xBA80…F6d5

    → Safe 4/7

    No delay · via Proxy upgrade · eip1967 admin

  • UpgradeCriticalYellow
    ProxyAdmin0x988D…07fF

    → Safe 3/5

    No delay · via Proxy upgrade · eip1967 admin

  • MintCriticalYellow
    OUSG InstantManagerOUSG_InstantManager0x9335…643a

    → Safe 3/5

    No delay · via CashKYCSenderReceiver.mint · onlyRole(MINTER_ROLE)

  • MintCriticalYellow
    Ondo token admin SafeSafe 4/70xAEd4…8367

    No delay · via CashKYCSenderReceiver.mint · onlyRole(MINTER_ROLE)

  • MintCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSG_InstantManager.setAdminSubscriptionChecker · onlyRole(DEFAULT_ADMIN_ROLE)

  • MintCriticalYellow
    OUSG price setter SafeSafe 3/60x682d…20C4

    No delay · via OUSG_InstantManager.adminSubscribe · ADMIN_SUBSCRIPTION_ROLE (capped by AdminSubscriptionChecker allowance)

  • Set priceCriticalYellow
    OUSG price setter Safe (shares all 6 owners with 0x682d…20c4)Safe 2/60xeAEf…BeFE

    No delay · via RWAOracleExternalComparisonCheck.setPrice · onlyRole(SETTER_ROLE)

  • Set priceCriticalYellow
    OUSG price setter SafeSafe 3/50x1189…9452

    No delay · via RWAOracleExternalComparisonCheck.setPrice · onlyRole(SETTER_ROLE)

  • Set priceCriticalYellow
    OUSG price setter SafeSafe 3/60x682d…20C4

    No delay · via RWAOracleExternalComparisonCheck.setPrice · onlyRole(SETTER_ROLE)

  • Set priceCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSG_InstantManager.setMinimumRwaPrice · onlyRole(CONFIGURER_ROLE)

  • Set priceCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSG_InstantManager.setOndoOracle · onlyRole(DEFAULT_ADMIN_ROLE)

  • Set priceCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoTokenRouter.setMinimumTokenPriceAndOracle · onlyRole(DEFAULT_ADMIN_ROLE)

  • Set priceCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoOracle.setHardcodedPrice · onlyRole(HARDCODED_SETTER_ROLE)

  • Set priceCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoOracle.setTokenToAggregatorV3Oracle · onlyRole(AGGREGATOR_V3_ORACLE_SETTER_ROLE)

  • Set priceCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoOracle.setTokenToOracleType · onlyRole(DEFAULT_ADMIN_ROLE)

  • Set priceCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoOracle.setTokenToRWAOracle · onlyRole(RWA_ORACLE_SETTER_ROLE)

  • Set priceCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSGOracleWrapper.setRwaOracle · onlyOwner (owner())

  • Allocate fundsCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSG_InstantManager.retrieveTokens, setOndoTokenRouter · onlyRole(DEFAULT_ADMIN_ROLE)

  • Allocate fundsCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoTokenRouter.setDepositTokenRecipient, setUserWithdrawTokenSources, setWithdrawTokenSources · onlyRole(DEFAULT_ADMIN_ROLE)

  • Grant rolesCriticalYellow
    OUSG price setter SafeSafe 3/50x1189…9452

    No delay · via RWAOracleExternalComparisonCheck.grantRole, revokeRole · DEFAULT_ADMIN_ROLE

  • Grant rolesCriticalYellow
    Ondo token admin SafeSafe 4/70xAEd4…8367

    No delay · via CashKYCSenderReceiver.grantRole, revokeRole · DEFAULT_ADMIN_ROLE

  • Grant rolesCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoIDRegistryView.grantRole, revokeRole · DEFAULT_ADMIN_ROLE

  • Grant rolesCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSG_InstantManager.grantRole, revokeRole · DEFAULT_ADMIN_ROLE

  • Grant rolesCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoTokenRouter.grantRole, revokeRole · DEFAULT_ADMIN_ROLE

  • Grant rolesCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoOracle.grantRole, revokeRole · DEFAULT_ADMIN_ROLE

  • Grant rolesCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSGOracleWrapper.transferOwnership · onlyOwner (owner())

  • Grant rolesCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoIDRegistry.grantRole, revokeRole · DEFAULT_ADMIN_ROLE

  • Grant rolesCriticalYellow
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoIDRegistry.setRWARole · onlyRole(RWA_ROLE_MANAGER)

  • FreezeHighRed
    OUSG registrar key (rwaRole in OndoIDRegistry)EOA0x059b…61a9

    None · via OndoIDRegistry.setUserID, removeUserAddresses · rwaRole(OUSG) or MASTER_CONFIGURER_ROLE

  • FreezeHighGreen
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoIDRegistry.setUserID, removeUserAddresses · rwaRole(OUSG) or MASTER_CONFIGURER_ROLE

  • FreezeHighGreen
    OUSG price setter Safe (shares all 6 owners with 0x682d…20c4)Safe 2/60xeAEf…BeFE

    No delay · via OndoIDRegistry.setUserID, removeUserAddresses · rwaRole(OUSG) or MASTER_CONFIGURER_ROLE

  • PauseHighYellow
    Ondo pauser SafeSafe 1/90x2e55…A2CC

    None · via CashKYCSenderReceiver.pause, unpause · onlyRole(PAUSER_ROLE)

  • PauseHighYellow
    Ondo pauser SafeSafe 1/90x2e55…A2CC

    None · via OUSG_InstantManager.pauseRedeem, pauseSubscribe · onlyRole(PAUSER_ROLE)

  • PauseHighGreen
    Ondo token admin SafeSafe 4/70xAEd4…8367

    No delay · via CashKYCSenderReceiver.pause, unpause · onlyRole(PAUSER_ROLE)

  • PauseHighGreen
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSG_InstantManager.unpauseRedeem, unpauseSubscribe · onlyRole(DEFAULT_ADMIN_ROLE)

  • Set complianceHighGreen
    Ondo token admin SafeSafe 4/70xAEd4…8367

    No delay · via CashKYCSenderReceiver.setKYCRegistry, setKYCRequirementGroup · onlyRole(KYC_CONFIGURER_ROLE)

  • Set complianceHighGreen
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OndoIDRegistryView.setKYCRequirementGroupToRwaToken, setOndoRegistry · onlyRole(DEFAULT_ADMIN_ROLE)

  • Set complianceHighGreen
    Ondo oracle and registry SafeSafe 3/50x5AE2…78eF

    No delay · via OUSG_InstantManager.setAcceptedRedemptionToken, setAcceptedSubscriptionToken, setOndoCompliance +1 more · onlyRole(DEFAULT_ADMIN_ROLE)

For regulated securities, freeze and force-transfer powers are often legally required. Control rates who holds them and what checks exist, not whether they exist. A single key holding a critical power or freeze is red; a multisig with no timelock is yellow.

Discovered at block 26,183,453 · 13 Oct 2026 · tool discovery-0.2.0 · View raw JSON on GitHub ↗