A detailed analysis of the RWA DeFi protocol Ondo Finance, which raised $24 million

Original title: Asset Risk Assessment: Ondo and Flux Finance (OUSG)
Original author: LLAMARISK
Original translation: Kxp, BlockBeats
About Ondo Finance
Ondo Finance is a blockchain services company that creates and manages institutional-grade financial products such as US Treasuries and money market funds, and builds DeFi protocols around these products. Ondo is committed to developing decentralized, composable protocols and providing tailored services to meet the needs of organizations, DAOs, and high-net-worth individuals. The platform aims to bridge the gap between TradFi and DeFi by bringing real-world assets (RWAs) into DeFi.
Ondo Finance was founded by Nathan Allman in 2021 and has raised $24 million to date from investors including Pantera Capital, Founders Fund, Coinbase Ventures, and Tiger Global. The team members have extensive backgrounds in various institutions and protocols such as Goldman Sachs, Fortress, Bridgewater, and MakerDAO.
Legal structure
Link: Ondo Legal Documents
Ondo Finance adopts a standard fund structure, including limited partners and general partners, as well as third-party service providers such as qualified custodians, fund administrators and treasury auditors.
Here is an overview of Ondo’s own legal structure:
Ondo Finance Inc: parent company
· Ondo I GP: General Partner (GP), responsible for managing the fund and directing the service providers.
· Ondo Capital Management LLC: Investment manager (Ondo IM), which manages the fund in partnership with the GP.
Ondo I LP: A Delaware limited partnership that receives capital contributions from investors and holds assets with third-party service providers. It is the issuer of OUSG.
Ondo Finance takes extensive security measures and works with reputable service providers such as Coinbase and Clear Street to ensure that funds are managed safely and efficiently. Qualified custodians are those institutions that have been approved by regulators to keep client assets separate in segregated accounts under the client's name.
Ondo uses the following third-party fund service providers:
Clear Street: A securities broker and qualified custodian that manages the fund’s over-the-counter assets and trade orders.
NAV Consulting Inc.: Provides third-party administrative services, including daily calculation of fund net asset values.
Coinbase Prime: Holds stablecoins, converts stablecoins to USD, and remits funds to Clear Street as directed by the investment manager.
The following diagram shows the relationship between these entities (from the MakerDAO forum proposal):
1. Ondo Finance wholly owns the investment manager and general partner
2. Investment managers are responsible for buying and selling ETFs
3. The general partner acts as the general partner of the fund
4. OUSG investors send stablecoins to the fund’s Coinbase account to purchase OUSG, and the fund sends OUSG to OUSG investors
5. The fund hired Coinbase to hold the stablecoins, convert the stablecoins into USD, and remit funds to Clear Street as directed by the investment manager
6. The Fund has engaged Clear Street to provide prime brokerage services and uses Clear Street to hold and trade assets.
7. The Investment Manager instructs Clear Street (CS) to execute trades, settle and custody the Fund’s assets in the Fund’s CS account
The fund has established access controls to ensure security, especially for third-party transfers. Coinbase's account only allows U.S. dollar wires to be sent to Clear Street's account. Clear Street's account wires are sent and received through its bank, BMO Harris, while Coinbase's wires are sent and received through its bank, Customer's Bank. To approve another account for a wire, the fund must first receive a wire from that bank account, send it to the fund's Coinbase account, and then work with a Coinbase representative to configure that bank as a trusted withdrawal destination. In addition, Ondo has maintained criteria for approving new bank accounts as transfer destinations.
Ondo I LP: OUSG Fund
Link: Ondo I LP Investor Documents
The Ondo I LP fund was created in February 2023, and its first product is the Ondo Short-Term U.S. Government Bond (OUSG). The iShares Short-Term Bond ETF (SHV), an index of U.S. Treasury bonds with maturities under one year, is the fund’s sole underlying asset. As of May 15, the ETF had net assets of $23.4 billion and average daily trading volume of more than $300 million.
The fund automatically reinvests dividends generated by its holdings. The fund’s expenses include the ETF management fee for the underlying assets (0.15%) and the management fee charged by Ondo (0.15%), with total expenses capped at 0.3%.
NAV Consulting produces daily certification of account balances and balance sheets. Ondo updates OUSG’s contract price daily based on this calculation. OUSG investors also receive regular monthly updates on the fund’s net asset value from NAV Consulting, and the fund undergoes an annual audit.
The figure below shows a recent certification document from the fund administrator that discloses the portfolio asset account (“Long Portfolio Value”) and various cash accounts for the fund’s liabilities.
This proof can be compared to the outstanding supply of OUSG and the most recent on-chain share price update (lastSetMintExchangeRate() in the CashManager contract). The current on-chain value is $118.4M, which matches the NAV proof in the image above.
An examination of Ondo Finance’s documents, including trial balances, statements of accounts and balance sheets, and comparison with on-chain data revealed no material discrepancies between NAV Consulting’s report and the on-chain data.
In terms of off-exchange protection, OUSG holders have SIPC insurance coverage with Clear Street, capped at $500,000, because Ondo Finance has an account with Clear Street, which is a SIPC member broker-dealer. However, the amount of SIPC insurance coverage is immaterial compared to the value of the Ondo I LP fund assets. It is also worth mentioning that the “Ondo I LP” account is a “cash account” (not a “margin account”), so Clear Street cannot re-hypothecate the account’s securities.
The legal documents relating to the Fund are available in this Dropbox , including detailed disclosure of the risk factors associated with the Fund in the Private Placement Memorandum.
investment process 
OUSG shares are issued as tokens on the Ethereum blockchain and can be minted/redeemed on US business days. These operations are handled by the Ondo Ops team, and the fund administrator (NAV Consulting) provides accounting services. In times of high redemption demand, the fund may not have sufficient liquidity on hand, and Ondo expects that redemption requests may take 2-3 days to process.
OUSG can be minted using at least $100,000 USDC or DAI. It is available to both US and non-US persons, although access to minting, redeeming, and transferring OUSG is restricted. Ondo uses smart contracts to enforce these transfer restrictions. Investors must undergo KYC/AML/CFT screening and must be both “Qualified Investors” and “Qualified Buyers.” Whitelisted users can only transfer their tokens on-chain to other whitelisted addresses. Whitelisted addresses are stored in a KYC registration contract and multi-signature processing is managed by Ondo.
The following workflow outlines the subscription and redemption process for investors investing in stablecoins:
Subscription (issuance) process:
1. Complete the KYC/AML process using Ondo, provide the required documents and pass the automated screening.
2. Review and sign fund documents.
3. Provide the Ethereum wallet address for whitelisting to subscribe, receive fund tokens and redeem them.
4. Send USDC to the fund’s smart contract for subscription.
5. The smart contract records your subscription request and immediately transfers USDC to the fund account of Coinbase Custody.
6. After the next daily NAV is calculated and your subscription request is accepted, you will receive OUSG representing your share of the Fund.
7. Ondo IM uses Clear Street’s USD to purchase the ETF.
8. Increase the fund value by purchasing more ETF shares and reinvesting them.
Redemption process:
1. Submit a redemption request by sending OUSG to the cash manager’s smart contract.
2. The smart contract records your redemption request.
3. Once the next daily NAV is calculated and your redemption request is accepted, Ondo IM will sell enough ETF shares to cover your redemption amount.
4. Clear Street will remit the corresponding USD to Coinbase and convert it into USDC.
5. Ondo IM will complete the redemption request and distribute USDC to the user’s wallet.
OUSG Access Control
Ondo authorizes the movement of funds between the blockchain and its fund account service providers (Coinbase Prime for stablecoin to USD conversion and Clear Street brokerage accounts for custody and trading ETFs). A custody agreement has been reached between Ondo, Coinbase and Clear Street regarding the authority and approval of fund transfers. Steps have been taken to securely structure access between brokerage and bank accounts to minimize employee access to fund accounts.
Ondo uses two multi-signatures to manage the on-chain part of its system. The team claims that each member is an employee of Ondo and needs to sign using a hardware wallet.
Ondo 3-of-6 Cash Management Multi-Signature
Configure minimum redemption and subscription amounts on the CashManager contract.
Configure rate limiter parameters on the CashManager contract (i.e. the number of subscriptions and redemptions that can be processed in a day).
Configure fee recipients on the CashManager contract (fees are currently turned off).
Set the exchange rate for OUSG minting.
Mint OUSG to meet subscription demand.
In case of emergency, suspend the functionality of the CashManager contract.
· In case of emergency, destroy the OUSG.
· In emergency situations, upgrade the OUSG implementation contract.
Implement an all-in-one function in the CashManager contract in case a user accidentally transfers tokens to the CashManager contract.
Ondo 3-of-7 Redemption Multi-Signature
· The stablecoins owned by it can be sent through the CashManager contract to meet redemption needs.
Introduction to Flux Finance
Flux Finance is a decentralized lending protocol developed by the Ondo Finance team and governed by Ondo DAO (ONDO holders). It is a fork of Compound V2 with minor modifications to handle permission tokens like OUSG. The protocol offers a variety of tokens for lending, such as USDC, DAI, USDT, and FRAX. OUSG is the only collateral asset and cannot be borrowed.
Flux's main goal is to create utility for OUSG assets and facilitate the process of bringing real-world assets to the blockchain in a compliant manner. This approach to decentralized finance (DeFi) aims to ensure that each token operates within the appropriate framework, promoting an environment that balances accessibility and compliance.
The following diagram shows how the Ondo and Flux ecosystems interact:
fTokens 
fTokens are similar to Compound’s common cToken standard. Flux Finance allows lenders to earn interest by supplying stablecoins to the platform and minting fTokens. These ERC-20 tokens represent balances on the protocol and earn interest via the fToken/Token exchange rate. The interest earned by the protocol is not distributed directly to lenders, but over time, the exchange rate of fTokens increases, allowing users to redeem more assets as interest accumulates. Flux Finance’s supply and lending rates are determined algorithmically based on supply and demand.
fTokens have additional functionality to support permission token restrictions, so that fOUSG can only be transferred between whitelisted addresses. Any interaction with fOUSG, including minting, redemption, or transfer, is checked against the kycRegistry contract, which stores whitelisted addresses. Additionally, if the transfer would cause the borrower's account liquidity to be negative, the transfer will fail, ensuring the stability and security of the protocol.
The Unitroller contract sets several parameters that affect the OUSG lending market:
Collateralization Factor: A value between 0 and 98% that represents the value that can be borrowed relative to the value provided.
· Closure Factor: A value between 5% and 90% representing the amount of a liquidable account borrowing that can be repaid in a single liquidation transaction.
Liquidation Premium: An additional percentage share of the liquidation value sent to liquidators as compensation.
Currently, the OUSG collateral factor is set to 92%, the closing factor is set to 50%, and the liquidation premium is set to 5%.
The tokens that can be borrowed and lent on Flux are as follows (with fToken contracts):
· Flux USDC（fUSDC）
· Flux DAI（fDAI）
· Flux USDT（fUSDT）
· Flux FRAX（fFRAX）
The tokens that can be used as collateral on Flux are as follows (with fToken contracts):
· Flux OUSG (fOUSG)
According to the TVL calculation method used by DeFi Llama, which includes borrowed amounts, the Flux protocol has a total locked value of $57.95 million as of early May 2023, of which 60% is OUSG. USDC is the asset with the largest supply (available for borrowing), followed by DAI.
OUSG/fToken Market Dynamics
Currently, there are 33 OUSG holders. The largest holder is Flux Finance (fOUSG), which holds approximately 31.05% of the total supply. Considering that OUSG currently only generates capital gains as collateral on the Flux protocol, the relationship between fOUSG supply and overall OUSG supply can be used as an indicator to measure the relationship between utilization and potential (maximum) OUSG capacity.
Regarding the permissionless portion of the protocol, fUSDC has 420 token holders, fDAI has 160, fUSDT has 76, and fFRAX has only 7. While supply (borrow) rates are competitive with larger money market protocols, on-chain adoption appears to be relatively low.
From the above chart, we can see that the utilization rate of permissionless fTokens is about 90%, reaching an equilibrium state where OUSG returns (underlying assets - SHV ETF returns) match the borrowing cost of the supported stablecoins. Given that permissionless fTokens can only be borrowed, while permissioned tokens OUSG are used exclusively as collateral, it can be inferred that permissionless fTokens at 90% utilization represent the maximum capacity that borrowers can borrow without incurring debt annualized yields (APY).
Borrowing APY at 90% utilization: 4.41%
Borrowing APY at 91% utilization: 4.78%
By accounting for administrative costs and reducing the annualized yield on the underlying collateral accordingly, OUSG depositors currently receive a yield of 4.3%. In comparison, the average borrowing cost is 4.575%, which is a small overall cost to borrowers.
Given the current utilization of lending protocols (and corresponding fTokens), it would be beneficial to add/allocate some external productivity to fTokens to meet the demand for using OUSG as collateral.
Curve fUSDC/fDAI 池
The Flux Curve pool has seen very little usage to date, despite being deployed just a month prior to writing this article. The pool has $2 million in funding staked by the team multisig. It does not yet have any substantial trading volume.
The pool is deployed as a V2 pool for assets that do not maintain a 1:1 peg. This is to account for the difference in interest accrual between fUSDC and fDAI. The team wanted to get a parameter pool as close to XY=k as possible while rebalancing liquidity. They chose to use the minimum values ​​for the A and gamma parameters, a very unusual choice that the team felt was best for the purpose of the pool.
The protocol aims to achieve an optimal borrowing rate, above which borrowing rates increase rapidly. Curve pools can help arbitrage fTokens around the optimal rate, and the additional incentives on Curve could increase demand for Flux lending.
Other types of DeFi integrations
The Ondo Finance team has already started working on the composability of fTokens. In addition to the current Curve proposal, they have also made a proposal to MakerDAO. MIP119 proposes to create a 500 million DAI reserve for Flux Finance's DAI lending pool.
Recently, another proposal with Frax went through a snapshot vote to activate an AMO that lends up to 2 million FRAX on Flux. Funding for that proposal is still awaiting deployment.
Flux Finance Governance
Flux Finance is governed by the Ondo DAO. ONDO holders have control over the economic parameters of the protocol, smart contract upgrades through on-chain proposals, and the OUSG oracle and lending protocol interest rate model contracts. While ONDO is currently non-transferable, users can use the token to vote on DAO proposals or delegate voting rights to other accounts.
Ondo DAO governance follows a standard two-step process:
Forum discussion
On-chain voting (managed by Tally)
The maximum total supply of ONDO is set at 10 billion ONDO, and will be allocated according to the following token allocation and unlocking plan:
At the time of writing, ONDO has 9,770 holders, all of whom have completed KYC in public and private sales. These token distribution programs are conducted through the Coinlist platform, where 11.31% of the total ONDO supply is allocated. The remaining unallocated ONDO, accounting for 88.69% of the supply, is held in the Treasury multi-signature wallet.
According to the Ondo DAO governance profile on Boardroom, the platform has raised six proposals since its launch, with 762 voters participating and a total of 1,589 votes cast. When reviewing the delegations, the two largest accounts (Account 1 and Account 2) together account for approximately 70% of the DAO's total voting power. While these accounts have voting restrictions, they can create and submit new proposals.
The two accounts with the highest voting power in Ondo DAO hold 202,806,000 ONDO, contributing approximately 70% of the voting weight of the DAO. However, these accounts are subject to voting restrictions, leaving 30% of the remaining weighted voting power available, equivalent to approximately 86,916,850 ONDO. Three representatives together account for 65.28% of the total weighted voting power, including:
1. glassmarkets.eth - ~240.63M VP (894 delegators)
2. 0xcd7979e12E2A502a280270827077Fd7f206f9a44 (inactive in previous proposals) - ~205,200 VP (193 delegators)
3. vexmachina.eth - 12.164M VP (33 delegators)
The voting limits for the above two accounts are set by the administrator of the Tally page.
It is clear that the Ondo Finance team has control over all decisions of the Flux protocol. Although the two accounts with the highest voting power are stated as non-voting accounts on the Tally page, this provision is not implemented in the Governor smart contract. In this case, the "non-voting" accounts can participate in the voting process at any time.
Flux Finance Multi-Signature Account
In addition to the two multi-signature accounts Ondo uses to manage OUSG assets, Flux uses two more multi-signature accounts for treasury and operational management. Flux claims that all members are employees of Flux Finance, a company based in the British Virgin Islands. These wallets include:
Flux Protocol Treasury Account 3/6 Multi-Signature
Holds more than 88.7% of ONDO supply
Neptune Foundation (fluxfinance.eth) 3/6 multi-signature
Control of the interest rate model and Oracle contracts of the Flux protocol until FIP-04 is implemented. Multi-signature authority has been transferred to the DAO.
fluxfinance.eth continues to provide the latest price data for OUSG on a regular basis, but limits the daily price movement to no more than 100 basis points. This limit is enforced by this address. The integration with Chainlink is being tested on the mainnet and is expected to be completed in the near future.
Risk Vector
Smart Contract Risks
Ondo Finance’s smart contracts have been audited by code4rena, which assessed the code for security and potential vulnerabilities. The audit evaluated 19 smart contracts, 5 summaries, and 6 interfaces, totaling 4,365 lines of Solidity code.
The Ondo team worked with C4A to address any critical vulnerabilities in the smart contracts. C4A auditors found six unique vulnerabilities, one of which was classified as high-severity and five as medium-severity. In addition, the audit included 54 reports detailing low-severity or non-critical issues, as well as 24 recommended gas optimization reports.
The key high-risk issue is called "Loss of User Funds When Completing Cash Redemptions", which involves the completeRedemptions function in the CashManager contract. The problem occurs when the amount refunded in a given period is not updated to the totalBurned storage variable for a given period. If the administrator uses multiple calls to the completeRedemptions function to complete refunds and redemptions at different steps or stages in a given period, any refunded amounts will not be considered in subsequent calls to the function. Even if the user redeems the same amount of CASH, this difference may cause the user to receive less collateral tokens than expected, resulting in the loss of user funds. The Ondo team worked with C4A to resolve this vulnerability.
Among the medium-risk issues, the “first deposit vulnerability” found in the Compound v2 smart contract deserves attention. This vulnerability allows an attacker to embezzle the funds of the initial depositors of a newly deployed cToken contract. The Ondo team solved this problem by enforcing a minimum deposit, which is implemented by minting a small number of cToken units to the 0x0 (burn) address on the first deposit, which cannot be withdrawn.
Flux Finance maintains an active bug bounty program on its protocol smart contracts, hosted on ImmuneFi. The program offers bounty payouts ranging from $1,000 to $550,000 in four categories based on the severity or impact of the vulnerabilities found:
Ondo Finance has paid a bug bounty to security researcher Ashiq Amien on January 26, 2022. The issue was related to the TrancheToken smart contract, which was part of the first Ondo Finance product, Ondo Vaults. Ondo Vaults was a financial protocol built on Uniswap that predates OUSG and has been decommissioned.
Governance risks
Flux Finance uses a two-stage governance process, including forum discussions and on-chain voting, to ensure community participation and reduce potential risks. Governance proposals are usually posted on the Flux Finance governance forum, where community members and teams can provide feedback. While this step is not mandatory, it increases the likelihood that the proposal will achieve good consensus and success.
After discussion in the forum, the final proposal will be submitted for a binding on-chain vote. Flux Finance's DAO is a fork of Compound's Governor Bravo, managing on-chain voting through Tally. Voting rights are determined by ONDO holdings, and holders can delegate their voting rights to other wallets.
Key DAO parameters include:
Proposal threshold: A minimum of 100 million ONDO voting power is required to submit a proposal, which helps prevent spam or malicious proposals.
Voting period: Community members can vote within a 3-day window.
Quorum: Proposals require at least 1 million ONDO voting power to pass.
Timelock: There is a 1-day delay between the end of the voting period and the execution of a successful proposal.
This governance structure ensures community participation, reduces risk, and promotes transparency in the Flux Finance decision-making process.
When reviewing the distribution of Ondo DAO’s voting power on Tally, we observed that governance appears to be highly centralized. Two governance accounts, “glassmarkets.eth” and “vexmachina.eth”, hold a total of approximately 34.91 million ONDO (including delegated tokens). Compared to the proposals with the highest participation rate, these two accounts have a considerable voting power of approximately 73.57%.
Additionally, the distribution of voting power within the platform is relatively concentrated, with three wallets holding a total of 65.28% of the total voting power (currently eligible to vote). This concentration of influence may raise concerns about platform governance and decentralization, highlighting the need for a more balanced distribution of voting power among participants.
This concentration of voting power raises concerns about the influence these entities have over the Ondo DAO governance decision-making process. For example, an entity like GlassMarkets only owns 57 Ondos, but has 894 addresses delegating voting power to it, making it the largest voter in the DAO.
Custody Risk
When assessing the risk of centralization, it is important to consider the underlying assets and infrastructure that support the Ondo Finance ecosystem. OUSG is not directly backed by U.S. Treasuries, but rather by the SHV ETF, which tracks the ICE Short-Term U.S. Treasury Security Index. SHV is an iShares Short-Term Treasury Bond ETF managed by Blackrock with approximately $23 billion in assets.
Another aspect of centralization risk within the Ondo Finance platform is its reliance on centralized exchanges such as Coinbase and Clear Street Brokerage Platform. Reliance on centralized service providers may expose the platform to additional counterparty risk and regulatory uncertainty from these institutions.
To address concerns about token backing and transparency, Ondo Finance utilizes third-party service providers such as NAV Consulting, a fund management company responsible for verifying fund assets directly from banks and custodian accounts. In addition, the fund undergoes independent annual audits. While Ondo Finance tokenizes management through its smart contracts, the fund administrator is responsible for maintaining off-chain records and providing monthly reports to investors. This process ensures daily reconciliation of token records and off-chain records.
Mortgage risk/solvency risk
During periods of extreme market volatility, there is a possibility of bad debt accumulation, although this risk can be considered quite low. Users should be aware of limitations and vulnerabilities that may lead to solvency risks.
Liquidation on Flux is similar to Compound V2, where an account will be liquidated when its loan-to-value ratio (LTV) is insufficient. At this point, a third-party liquidator can pay a portion of the borrower's debt and seize the corresponding collateral at a discount. However, unlike Compound, Flux's liquidation complies with OUSG's KYC requirements. To liquidate with OUSG as collateral, the liquidator must complete KYC and be whitelisted to hold the token. A limited pool of authorized liquidators may increase the likelihood that liquidations will not be completed in a timely manner.
Liquidations are expected to be rare. Flux currently only supports stablecoin markets, which are generally less volatile. However, in cases of extreme volatility, when LTV increases so quickly that liquidations cannot be made in a timely manner, the net worth of an account may become negative, causing bad debts to accumulate for the protocol and its debits. Flux Finance's assets are generally very stable, so bad debt accumulation is extremely unlikely. As an additional safety mechanism, Flux's stablecoin oracles will never price stablecoins above 1 USDC, reducing the risk of external oracle manipulation.
The Flux team's assessment of the likelihood of bad debts is as follows:
Given that Flux’s assets (tokenized bonds) are generally very stable, bad debt accumulation on Flux should be extremely unlikely. The maximum weekly volatility of the SHV Short-Term Bond ETF has been less than 0.5% since its creation in 2007. Given that loan liquidations for OUSG start at 92% LTV, this provides a huge margin of safety for borrowers on Flux.
In the unlikely event that bad debts accumulate, Flux’s market reserves will first be used to cover losses. If the reserves are insufficient, some borrowers may not be able to withdraw their assets.
Oracle Risk
The tokenized securities protocol uses NAV Consulting services to provide a daily updated price feed mechanism to ensure accurate valuation of the underlying collateral. This is only a temporary solution, and the Ondo team is developing an on-chain oracle to provide real-time price updates.
NAV Consulting has limited API access to Coinbase and Clear Street’s fund accounts and can only view data but cannot make any changes. NAV Consulting calculates the net asset value (NAV) of each token every day using a specific method that can be described as the following three steps:
Sum the present value of all fund assets (SHV shares, cash and stablecoins)
· Then subtract the fund's accrued expenses and management fees
Finally, divide the result by the total number of tokens
Ondo updates the contract price daily using calculations from NAV Consulting.
Flux Finance recently implemented a governance proposal to increase transparency of price feeds and reduce reliance on the team. One of the key components of the proposal is the deployment of a new oracle controlled by the Ondo DAO. This oracle will serve as the primary mechanism for retrieving prices of underlying assets for the Flux Finance protocol. The proposal also implemented a 100 basis point limit on daily price fluctuations of OUSG, effectively reducing the risks associated with price volatility.
A newly implemented price oracle, FluxOracle, is used to manage the market. The contract implements a hardcoded price of the underlying asset for the stablecoin fToken (Oracle Type-1) and uses RWAOracleRateCheck to check the underlying asset price of the "authorized" fToken, which currently only has fOUSG (Oracle Type-2). Additionally, the contract provides the option to configure a Chainlink oracle (Oracle Type-3).
The FluxOracle contract also implements role-based access control, where DEFAULT_ADMIN_ROLE can set the role for any address of each oracle type:
· STABLECOIN_HARDCODE_SETTER_ROLE
· TOKENIZED_RWA_SETTER_ROLE
· CHAINLINK_ORACLE_SETTER_ROLE
All roles are set to timelock contracts controlled by Ondo DAO.
Flux has been testing a Chainlink price feed for SHV/USD. The price feed has been deployed, and they are testing a contract on mainnet that limits price updates based on the SHV/USD feed. In the near future, this contract will be used by the official Flux oracle.
Llama Risk Assessment Criteria
Centralization Factor
1. Is it possible for a single entity to deceive users?
While it is possible for a single entity to manipulate the protocol, several safeguards have been put in place to minimize this risk. Ondo Finance uses three multi-signature wallets (Ondo Admin Multi-Signature, OUSG Redemption Multi-Signature, and ONDO Holder Multi-Signature), each of which requires at least three signatures to execute.
While this setup theoretically allows three multi-signature signatories to coordinately manipulate the system, the requirement for multiple signatures adds an extra layer of security. This structure helps mitigate the risk of a single entity subverting the protocol and ensures that decision-making power is dispersed among multiple parties.
2. If the team disappears, can the project continue to run?
As a physical issuer of securities, OUSG has full reliance on the ongoing operations of the team for the management of Ondo I LP (the Fund).
The Flux protocol currently requires manual price updates from the team, though it may transition to Chainlink price feeds in the near future. At that point, Flux can continue to operate fully autonomously (though since the Flux team is also the Ondo team, the project still relies on Ondo’s continued operations).
economic factors
1. Does the feasibility of the project depend on additional incentives?
Ondo Finance's continued viability is not dependent on additional incentives. The project's focus on its basic financial services during development suggests that its sustainability is not dependent on external incentives. However, it is critical to monitor future developments or any changes to the project's structure that could affect its risk profile.
2. If demand drops to zero tomorrow, will all users be reimbursed?
OUSG is backed by the SHV ETF, which is designed to provide a basis for redemptions if demand drops to zero tomorrow. In this case, the SHV ETF backing is designed to ensure that Ondo Finance has the ability to continue to honor redemption requests, keep all users repaid, and provide a degree of financial security and protection. SHV is very liquid, with an average daily trading volume of over $300 million, while short-term bonds are less affected by interest rate changes.
The usual fixed income risks remain, with interest rate risk and credit risk being the main concerns. Generally speaking, as interest rates rise, bond values ​​tend to decline. Credit risk relates to the possibility that the bond issuer may be unable to meet its obligations regarding principal and interest payments. Investors need to clearly understand that an investment in the Fund is not insured or guaranteed by the FDIC or any other government agency. These risks are associated with the U.S. Treasury market in general and not with Blackrock/Ondo.
safety factors
1. Did the audit reveal any signs of concern?
C4A’s audit of Ondo Finance’s smart contracts did find several vulnerabilities, including one high-risk issue and five medium-risk issues.
However, the Ondo team worked closely with C4A to resolve any critical vulnerabilities in the smart contracts. The high-risk finding titled “Loss of user funds when completing CASH redemptions” has been resolved in collaboration with the audit team.
Risk team recommendations
After evaluating Ondo Finance and Flux Protocol, we believe that they operate well within acceptable risk parameters, but we also recognize that there are areas that can be improved to enhance the security, decentralization, and transparency of the platforms:
Addressing the centralization of governance and voting power in Ondo DAO. Implementing mechanisms to reduce the centralization of voting power can promote a more decentralized and democratic governance system. It is important to ensure that the decision-making process is more inclusive and influence is distributed among more participants.
Improve the security and stability of Ondo Finance by addressing potential risks with smart contracts, oracles, and collateral. Regular audits and updates to the platform’s security features will help build a stronger and more reliable ecosystem. It is critical to ensure that all identified vulnerabilities are addressed and steps are taken to prevent future issues.
Improve transparency in Ondo Finance’s operations by providing more detailed documentation on the platform’s functionality, risks, and mitigation strategies. This will enable users to make informed decisions about participating in the platform and increase their understanding of the project’s objectives and potential risks.
In our work with Ondo and the Flux team, we found them to be extremely professional, taking all reasonable precautions to ensure the security of the system and provide assurance to users. We believe Flux is an excellent example of bringing regulatory compliant real assets to DeFi, and look forward to further integration with Curve.
Original link