DefiCareDefiCare
Checking auth...

Ondo Finance

About

Ondo Finance designs institutional-grade platforms, assets, and infrastructure to bring traditional financial markets onchain. Its product suite includes yieldcoins (USDY for non-US retail and institutional investors, OUSG for qualified purchasers) backed by short-term US Treasuries with daily distributed yield, a Global Markets platform offering 200+ tokenized stocks and ETFs with instant mint/redeem and total-return tracking (price appreciation plus reinvested dividends), and Ondo Perps for perpetual futures on equities and commodities. Ondo also develops Ondo Chain, a purpose-built Layer 1 for omnichain real-world assets, and supports DeFi utility via Flux Finance (onchain treasury repo market) and integrations across multiple blockchains.

Where Does Yield Come From?

Ondo Finance generates yield across several separate product lines. Here is how each one works.

1. Yieldcoins (USDY and OUSG)

USDY (US Dollar Yield) — A transferable token available to investors outside the US. The token passes along the yield earned from a mix of short-term US government bonds (Treasuries). Ondo sets the APY (annual percentage yield) each month, following the rules in USDY's governing documents. The token is designed to stay at least 3% over-collateralized (meaning assets backing it exceed the token value by at least 3%), checked quarterly by an outside fund administrator.

OUSG (Ondo Short-Term US Treasuries Fund) — A token for Qualified Purchasers and Accredited Investors. It invests mainly in a short-term Treasury ETF called SHV, managed by BlackRock. The token's price goes up over time, reflecting the yield on the underlying bonds minus fund costs. The APY is figured by annualizing the price change over the prior 30 days.

Both yieldcoins share these features:

  • Instant minting (creating tokens) and redemption (cashing them out), any time, every day of the year
  • OUSG minimum: $5,000; USDY minimum: $500
  • Daily reserve checks by an outside party
  • Legal structures that keep the assets separate from Ondo (bankruptcy-remote)

2. Ondo Global Markets

This platform issues tokenized versions of stocks, ETFs, and ADRs. Each token tracks the total return of a real US-listed security — meaning the token's value moves with the stock price and also includes reinvested dividends (minus any withholding taxes that apply). There is no extra yield beyond what the underlying security itself earns; dividends are automatically reinvested by design.

Each token is fully backed 1:1 by the real security held at US-registered broker-dealers. An independent Verification Agent checks this backing daily. A Security Agent holds a first-priority legal claim on the assets. Minting and redemption (available Monday through Friday, 24 hours a day) happen at the cash value of the underlying asset.

3. Ondo Perps

A platform for perpetual futures — a type of leveraged trading — on major US stocks, ETFs, and commodities. It runs 24/7. Whether you earn yield or pay a cost depends on funding rates (periodic payments between long and short traders) and the direction of your position.

4. Flux Finance (now owned by the Ondo Foundation / Ondo DAO)

This is the first onchain Treasury repo market — think of it as a lending marketplace where Treasury-backed tokens serve as collateral. OUSG tokenholders can pledge their OUSG as collateral to borrow stablecoins. When they do, they receive receipts called fOUSG that have built-in transfer restrictions to stay compliant with regulations.

Where Ondo itself earns revenue

  • USDY and OUSG include management and administrative fees built into the fund structures (the exact fee percentages are in the offering documents).
  • Tokenized securities (Global Markets) charge fees embedded in the spread between mint and redeem prices, plus custody arrangements, as disclosed in the prospectus filed with the Liechtenstein FMA (Financial Market Authority).

There is no single unified fee or emission stream across all products; each product's fee design is described in its own governing documents.

Persons

  • Nathan Allman

    Chief Executive Officer

    LinkedIn
  • Ian De Bode

    President

    LinkedIn
  • Patrick McHenry

    Vice Chairman

  • Mark Janoff

    General Counsel

    LinkedIn
  • Brendan Florez

    Managing Director of Client Relations and Strategic Operations

    LinkedIn
  • Katie Wheeler

    VP, Partnerships

    LinkedIn
  • Ben Grossman

    VP, Marketing

    LinkedIn
  • Carter Lathrop

    Web Engineering Lead

    LinkedIn
  • Cameron Clifton

    Head of Engineering

    LinkedIn
  • Justin Schmidt

    Advisor

    LinkedIn

Audits

Audit / DateFindingsVerdict
Spearbit17-06-2025
  • Critical0
  • High0
  • Medium2
  • Low2
  • Info3
The audit disclosed no critical or high-severity issues, and all 2 medium-severity findings were fixed and verified before the report; the remaining low and informational items were either fixed or acknowledged, indicating a solid security posture for the Ondo RWA Internal protocol at the reviewed commit.
Cyfrin01-07-2025 - 14-07-2025
  • Critical0
  • High0
  • Medium0
  • Low2
  • Info10
The audit found no critical, high, or medium severity vulnerabilities, only two low-risk issues (one resolved, one acknowledged) and ten informational items that were all fixed, indicating the Ondo Global Markets codebase was in a strong security posture at the time of review.
FYEO08-09-2025
  • Critical0
  • High0
  • Medium1
  • Low0
  • Info1
The two new issues (one medium, one informational) are both logged as open, meaning they were not resolved as of this review; however, the auditor concluded the program's security features remain robust overall, with the medium finding related to a silent failure in list management rather than a direct fund-loss vector.
Cantina05-10-2025 - 06-10-2025
  • Critical0
  • High0
  • Medium1
  • Low2
  • Info5
The audit revealed no critical or high-severity vulnerabilities; the single medium-risk finding and all informational items were resolved, and the low-risk precision-loss finding was acknowledged as acceptable, indicating a well-secured codebase suitable for deployment.
FYEO05-11-2025
  • Critical0
  • High2
  • Medium0
  • Low2
  • Info2
The review update uncovered two high-severity attestation-layer issues (missing user binding and replay protection) that remain open, posing material risk to user funds if shipped without remediation; the lower-severity findings are primarily code-quality concerns. The program should not be deployed to mainnet until the two high-severity findings are resolved and re-audited.
Cantina17-11-2025 - 18-11-2025
  • Critical0
  • High0
  • Medium0
  • Low1
  • Info4
The review found no critical, high, or medium severity vulnerabilities, indicating the SyntheticSharesOracle contract has a strong security baseline; the one Low finding reflects intentional spec deviations rather than exploitable flaws, and both code fixes (PR 500, PR 501) were verified by Cantina.
Cantina02-12-2025 - 03-12-2025
  • Critical0
  • High0
  • Medium0
  • Low0
  • Info1
This review found no security vulnerabilities (critical, high, medium, or low), with only gas optimizations and one informational issue reported — all of which were remediated and verified. The protocol's core security posture in the reviewed scope appears sound.
  • Critical1
  • High4
  • Medium8
  • Low30
  • Info16
All critical, high, medium, and low severity findings have been fixed and verified by Cantina, leaving no open security issues in the audited commit; the informative items were either acknowledged or resolved, indicating a thoroughly remediated codebase at the time of publication.
Zellic12-12-2025 - 23-12-2025
  • Critical0
  • High0
  • Medium0
  • Low0
  • Info1
The audit found no critical, high, medium, or low severity vulnerabilities; the sole informational finding regarding deprecated `realloc` usage was acknowledged and remediated by Ondo Finance. For a protocol handling tokenized securities on Solana, the codebase exhibited a strong security posture within the assessed scope.
Cantina Managed31-01-2026 - 02-02-2026
  • Critical0
  • High0
  • Medium0
  • Low2
  • Info3
The audit found no critical, high, or medium security vulnerabilities; the two low-risk issues were either fixed or addressed with acknowledged operational mitigations, indicating a sound security posture for the limit-order protocol at the reviewed commit.
Spearbit25-02-2025 - 16-03-2025
  • Critical0
  • High0
  • Medium1
  • Low6
  • Info11
The single medium-severity vulnerability (a DOS in subscription/redemption due to an inverted subtraction) was fixed, and the low-severity issues were largely remediated; overall the audit indicates that Ondo Finance's RWA contracts were adequately hardened before deployment, though operators should remain mindful of acknowledged design choices around rate-limit resets and oracle-settable prices during freezes.
Halborn27-11-2024 - 31-12-2024
  • Critical0
  • High0
  • Medium1
  • Low1
  • Info3
The Halborn audit found no critical or high-severity issues, with the single Medium-risk vulnerability (unsafe ERC20 transfers) fully remediated through SafeERC20 adoption, and all remaining findings addressed by the Ondo Finance team, indicating a solid security posture for the audited contracts.
Code4rena29-03-2024 - 03-04-2024
  • Critical0
  • High1
  • Medium4
  • Low0
  • Info0
The one high-severity finding (USDC depeg exploitation) is confirmed and being mitigated via a USDC/USD oracle, but the two disputed medium-severity issues (trapped funds from minimum withdrawal limits and KYC block on burning) represent residual design risks that users and operators should evaluate.
Cyfrin08-04-2024 - 18-04-2024
  • Critical0
  • High0
  • Medium0
  • Low7
  • Info7
The audit found no critical, high, or medium severity issues, and all seven low-risk findings were remediated by Ondo Finance — demonstrating a strong security baseline for the scoped contracts. The protocol's inherent centralization (KYC/regulatory controls and admin seizure capabilities) remains the primary trust assumption for users.
Code4rena01-09-2023 - 07-09-2023
  • Critical0
  • High0
  • Medium4
  • Low10
  • Info2
The audit found no critical or high-risk vulnerabilities, with four medium-severity issues all acknowledged or confirmed and rectifiable via documented mitigations; overall protocol safety is adequate for mainnet deployment provided the bridging and access-control edge cases are addressed as recommended.
  • Critical0
  • High0
  • Medium0
  • Low0
  • Info0
The audit found no critical vulnerabilities, and the identified high-to-informational issues were either resolved or acknowledged by Ondo Finance, suggesting the contracts were reasonably secure at the time of review. However, the exact severity breakdown is not reliably extractable from the garbled PDF conversion, so the numeric counts should be treated with caution.
Nethermind06-04-2023
  • Critical0
  • High0
  • Medium1
  • Low4
  • Info4
The audit found no critical or high-severity vulnerabilities, with the one medium issue (rounding in basis-point bounds) acknowledged by the team as operationally negligible and partially fixed; all low and informational issues were either fixed or acknowledged, indicating a reasonable security posture for the oracle contracts at the time of review.
Code4rena11-01-2023 - 17-01-2023
  • Critical0
  • High1
  • Medium5
  • Low0
  • Info0
The contest identified one high-severity finding (loss of user funds in CASH redemptions) and five medium-severity findings spanning access control, oracle inflation, signature replay, and admin operational risks; all confirmed issues were acknowledged and resolved by Ondo Finance, and the protocol's lending market initialization mitigates the first-deposit vector operationally.
Halborn03-06-2024 - 21-06-2024
  • Critical0
  • High0
  • Medium3
  • Low0
  • Info7
No critical or high-severity issues were found; the three medium-severity findings were either fixed or formally risk-accepted, and all informational items were acknowledged. The audit indicates a low residual security risk for the Noble Aura module in scope.
Halborn01-07-2024 - 05-07-2024
  • Critical0
  • High0
  • Medium0
  • Low0
  • Info1
The audit found no critical, high, medium, or low severity vulnerabilities, with the sole informational finding acknowledged by the team, indicating a clean security posture for the scoped Aura Module updates.
ABDK Consulting25-10-202226-10-2022
  • Critical1
  • High4
  • Medium7
  • Low179
  • Info0
All identified critical, moderate, and most major issues were fixed, with residual minor/informational items largely reflecting the team's preferred style-guide choices; the audit indicates Ondo's contracts were remediated for the most impactful vulnerabilities before deployment.
Quantstamp01-12-2021 - 22-12-2021
  • Critical0
  • High4
  • Medium1
  • Low6
  • Info11
The audit identified several high-severity issues, two of which (logical bugs in strategy accounting) were fixed, while the guardian-privilege issues were accepted as by-design with multisig mitigations, leaving residual centralization risk that users must trust the guardian multisig. Overall the report indicates a reasonable security posture with acknowledged trust assumptions, though extensive external dependencies and code duplication present ongoing maintenance and third-party risk.
Quantstamp23-08-2021 - 03-09-2021
  • Critical0
  • High0
  • Medium4
  • Low6
  • Info4
The audit found no critical or high-severity issues, but 4 medium-risk findings (sandwich attacks, hardcoded fee assumptions, share truncation, and incorrect path validation) and 6 low-risk findings (centralization risk, pausing gaps, missing input validation) all remained unresolved at the time of the report, indicating material residual risk that should be addressed before mainnet deployment.
PeckShield16-05-2021
  • Critical0
  • High1
  • Medium5
  • Low5
  • Info0
The audit found the Ondo codebase well-structured with promptly addressed issues, though two medium-severity items (admin key centralization and performance fee calculation) were confirmed and not code-fixed, meaning governance reliance remains a residual risk for users.

Legal

Legal form

Multi-entity structure: Ondo Finance Inc. (Delaware corporation), Ondo Global Markets (BVI) Limited (British Virgin Islands business company/SPV), Ondo I LP (Delaware limited partnership), Ondo Capital Management LLC (Delaware LLC, SEC-registered investment adviser), Ondo Foundation (entity type not further specified), and Flux Finance Inc. (wholly owned subsidiary of Ondo Foundation).

Registration jurisdiction

Ondo Finance Inc. — Delaware, USA; Ondo Global Markets (BVI) Limited — British Virgin Islands; Ondo I LP — Delaware, USA; Ondo Capital Management LLC — Delaware, USA (SEC-registered investment adviser); Ondo Foundation — not explicitly stated on fetched pages; Flux Finance Inc. — Delaware, USA (per context as wholly owned subsidiary of Ondo Foundation).

Status and notes

Official homepage footer and docs.ondo.finance legal/regulatory pages disclose: Ondo Finance Inc. (Delaware corporation) provides tokenization services to and holds equity in Ondo Global Markets (BVI) Limited. Ondo Global Markets (BVI) Limited issues Ondo GM Tokens (tokenized stocks/ETFs) and USDY tokens as structured notes (debt instruments) governed by Swiss law. Ondo I LP (Delaware LP) issues OUSG tokens. Ondo Capital Management LLC is the SEC-registered investment adviser to Ondo I LP. The Ondo Foundation owns Flux Finance Inc., which owns 90.01% of Ondo Global Markets (BVI) Limited (the remaining 9.99% held by Ondo Finance Inc.). Terms of Service and Privacy Policy are referenced at docs.ondo.finance/legal/ but timed out on fetch attempts (30s navigation timeout). Disclaimers page available at docs.ondo.finance/legal/disclaimers. Cookies Policy and Ondo Summit 2026 Terms also listed in the legal navigation. The website footer links to Terms of Service and Privacy Policy. Legal counsel includes Davis Polk, Clifford Chance, ACA, and RSM (listed as compliance/audit service providers on homepage).