TL;DR
- What it is: Tokenized US Treasuries + bank deposits, issued by Ondo Global Markets (BVI) Limited under Reg S to non-US persons only. Per Ondo’s own portfolio page (as of 2026-07-20): 98.71% US Treasuries, 0.14% bank deposits — plus 1.15% “Ondo Stocks issued USDY”, i.e. USDY collateralised by USDY (Risk #2). ~$2.14B outstanding across 11 chains as of the Jun-2026 review (Ankura/Ondo; not re-pulled this pass — public trackers combine USDY+OUSG); the Ethereum slice is bridge-transient, ~$1.11B today but it swung 160M–967M USDY in May 2026 alone.
- Yield source: Carry on short-dated US Treasuries (WAM 179.69d, blended 177.38d — not the ~160d the prior review carried), variable rate set monthly by Ondo — on-chain price accrued 0.44% over the 46d to 2026-07-21 (≈3.5% annualized). Yield accrues into the redemption price via the on-chain oracle; no token incentives.
- Biggest risk: Admin can retroactively rewrite the on-chain price via
overrideRange()on the oracle, with no timelock and no forward-only constraint (Risk #1). - For detail: Ankura Trust monthly + daily attestations; Spearbit/Cantina audit (Mar 2025); LlamaRisk overview (stale, predates OGM restructure and 4× AUM growth).
How it works
USDY is a yield-bearing ERC-20 issued by Ondo Global Markets (BVI) Limited — a bankruptcy-remote SPV that absorbed the original Ondo USDY LLC in December 2025. Holders hold a first-priority security interest in the underlying assets, with Ankura Trust Company as Verification and Collateral Agent (read-only access to custodial accounts, wind-down authority on default). Backing per Ondo’s live portfolio page (as of 2026-07-20, accessed 2026-07-21): 98.71% US Treasuries ($2.14B, WAM 179.69d, YTM 3.77%), 1.15% “Ondo Stocks issued USDY” ($25.0M — USDY posted as collateral for USDY), 0.14% bank deposits ($3.0M, shown as a Silicon Valley Bank line; SVB is a First Citizens division). Named partners on that page are StoneX and Ankura. The prior review’s “BNY Mellon via Marex, 93% concentration” is not supported by any reachable primary source and is contradicted by this disclosure — see Risk #2. Non-US persons / non-US institutions only under SEC Reg S.
The price is not a market feed — it’s a pre-programmed compound interest calculator. RWADynamicOracle (0xA0219AA5B31e65Bc920B5b6DFb8EdF0988121De0) stores monthly “ranges” (start time, end time, daily rate, previous close). Ondo’s two SETTER_ROLE multisigs (a 4/7 Safe and a 4/8 Safe) call setRange(endTimestamp, dailyRate) each month; on-chain getPrice() then deterministically compounds (= $1.140159, 2026-07-21). Normal setRange() cannot reduce the price (rate ≥ 1.0×). But the 4/7 admin Safe (0x1a694A09494E214a3Be3652e4B343B7B81A73ad7) holds DEFAULT_ADMIN_ROLE (hasRole = true, re-verified 2026-07-21) and can call overrideRange() to retroactively modify any past range — rate, timestamps, or start price — with no constraint and no timelock (getModulesPaginated() = []). The same Safe owns the USDY token’s ProxyAdmin (ProxyAdmin.owner = 0x1a694A09…, confirmed 2026-07-21) and holds MINTER_ROLE on USDY directly. It does not hold every Ondo role, as the prior review stated: a separate 3-of-5 Safe (0x5AE21c99…78eF) administers the oracle-wrapper layer that InstantManager reads — a lower threshold than the 4/7 and the cheaper path to a mispriced mint (see Key-compromise threshold).
Mint and redeem flow through InstantManager (0xa42613C243b67BF6194Ac327795b926B4b491f15). Redemption requires KYC enrollment in OndoIDRegistry, accepts USDC only (no USDT/DAI), and is rate-limited to $15M/day globally and $10M/day per user — re-verified directly on OndoRateLimiter (0x98Db5022…003c) on 2026-07-21 (globalRedemptionLimits(USDY).limit = 15,000,000e18 / 86,400s; defaultUserRedemptionLimitConfigs(USDY).limit = 10,000,000e18 / 86,400s), closing a figure the prior eval carried forward unverified since 2026-05-11. Subscription side, for reference: 100M/day global, 50M/day per user. USDC is pulled from a pre-funded 3/6 Ondo Safe (0x3312cc371fe0dd5171878630a1e5cf69778e8fa5, ~$30.6M, refilled from ~$18.8M at last review) via a TokenRouter/BasicSource relay — if the pool drains, redeem() reverts (no queue, no IOU). On some chains there is a 40–50 day post-mint transfer lock; Ethereum mainnet currently has no transfer lock at the token level. Cross-chain transfers use a LayerZero V2 OFT adapter (0xa6275720b3fB1Efe3E6EF2b5BF2293148852307D) holding MINTER_ROLE, with a 4-of-4 required DVN set (Ondo, LayerZero Labs, Canary, Fidelity FCAT) on Arbitrum/Solana paths — well above the 1-of-1 setup that the rsETH bridge exploit (Apr 2026) abused.
Capital quality. Two on-chain signals, both reassuring on integrity but limiting on retention. (1) getPrice() has risen strictly monotonically (1.1055 → 1.1402, Sep-2025 → Jul-2026) — overrideRange() has never been used and no loss has been booked; the oracle behaves. (2) Yield is real T-bill carry with no token emissions, so the capital is not mercenary/incentive-chasing. But retention is not measurable as organic stickiness: the Ethereum holder base is thin and institutional — the top two holders were Safe multisigs at ~68% combined (top-4 ≈ 88%, 2026-06-05; cohorts not re-pulled this pass, and their KYC-enrolment status is unconfirmed) — and the Ethereum supply is a LayerZero bridge-routing artifact (burn-and-mint), swinging 160M → 967M USDY within May 2026, so it is not an organic-retention cohort. Supply has since been flat at ~970M for six weeks, which is quiet rather than informative. Per the permissioned-RWA method, the durability read rests on redemption mechanics (rate-limited, pool-dependent, KYC-gated — Risk #4) and issuer integrity, not on holder behavior. The Jan-2026 thin-OC breach during a 2× AUM surge (Risk #3) was growth-induced and self-resolved; getPrice was unaffected.
Risks
Verified on-chain (2026-07-21, block 25,582,684): getPrice() and its monotonic range history, the 4/7 admin Safe’s threshold + DEFAULT_ADMIN_ROLE + MINTER_ROLE + ProxyAdmin ownership, the separate 3-of-5 oracle-wrapper Safe, PAUSER_ROLE membership (1-of-9), both redemption rate limits, the USDC pool balance, USDY supply, and the Chainalysis sanctions-oracle attribution. Verified against Ondo’s live portfolio page (as-of 2026-07-20): backing composition, WAM, named partners. Carried forward, not re-verified: LayerZero DVN configuration (2026-05-11), holder-concentration cohorts (2026-06-05), cross-chain AUM. Taken on trust / not publicly verifiable: Ankura attestations and every figure derived from them — including the Jan-2026 OC breach and the OC ratio itself — plus the legal continuity of the Dec-2025 entity restructure.
| # | Risk | Mechanism | Source + NOCA delta |
|---|---|---|---|
| 1 | Admin oracle override with no timelock | overrideRange() on RWADynamicOracle (0xA021…1De0) lets DEFAULT_ADMIN_ROLE (4/7 Safe, 7 owners, no timelock module — getModulesPaginated() = [], re-verified 2026-07-21) retroactively rewrite any range’s rate, timestamps, or start price. Single tx changes live getPrice() immediately, enabling mispriced mints/redeems via InstantManager. Same 4/7 Safe also owns ProxyAdmin and can upgrade the USDY token logic. Exit if any overrideRange() call is observed without a published Ondo justification, or if the 4/7 Safe adds/removes signers without notice. | On-chain verification (2026-07-21). LlamaRisk (Oct 2023) flagged centralized oracle; we add that overrideRange() is the specific function that breaks the forward-only invariant — still live, still unused: getPrice has risen monotonically across another quarter. |
| 2 | Custody model unresolved — the prior review’s Marex framing does not hold | The eval asserted “93% of backing at Marex via BNY Mellon”. Ondo’s own live portfolio page (2026-07-20) names StoneX and Ankura and mentions neither Marex nor BNY Mellon; no reachable primary source supports the old claim. Either custody migrated (which was itself the prior row’s exit trigger) or the attribution was always wrong — we cannot currently tell which, and Ankura’s attestations are not public. Separately, the page discloses 1.15% ($25.0M) of backing as “Ondo Stocks issued USDY” — USDY collateralising USDY, a circular slice the prior review never flagged. Do not rely on a single-custodian risk number until re-sourced. Exit trigger, restated: any disclosed custodian change, or growth in the self-referential slice. | Ondo portfolio page, accessed 2026-07-21 (primary). Hindenrank (Apr 2026) flagged single-custodian concentration generally; the specific counterparty is now unverified, so this row is a known-unknown, not a quantified risk. |
| 3 | Thin overcollateralization, already breached once | Permitted Assets / Token Principal hovers at ~100.5%. Breached in Jan 2026 (ratio fell to 1.00416, Portfolio Default = YES) when AUM doubled intra-month ($727M → $1.41B) and asset acquisition lagged token issuance. At the actual 179.69-day WAM (not the ~160d previously used), a 100bps rate rise causes a ~0.49% NAV decline — more than the entire buffer, so the duration risk is worse than the prior review stated. Exit if OC ratio < 100.25% for >7d or if a second Portfolio Default flag appears. | WAM from Ondo’s portfolio page (2026-07-21). The Jan-2026 breach specifics come from Ankura attestations that are not public — carried forward, unverifiable by us, and flagged as such. Issuer frames it as growth-induced and self-resolving; we add that the buffer is structurally inadequate for both rapid inflows and rate-driven MTM losses. |
| 4 | Rate-limited, KYC-gated, pool-dependent, concentrated redemption | InstantManager redemption is bounded by $15M/day global + $10M/day per-user (24h rolling, OndoRateLimiter 0x98Db…003c, both re-read on-chain 2026-07-21 — unchanged), gated by OndoIDRegistry KYC, and sourced from the ~$30.6M pre-funded 3/6 USDC pool Safe (0x3312…8fa5, 2026-07-21). The Ethereum holder base is concentrated — top-2 were Safes at ~68% of supply (2026-06-05, not re-pulled; and we should not assume they are KYC-enrolled — enrolment is a separate registry state we have not confirmed, so they may not be able to use InstantManager at all) — so a single peer exit ($300M+) is ~20× the daily global limit; at $15M/day the queue is the binding constraint, not a tail. The pool improved this quarter: it now covers ~2.0d at the max global rate (vs ~1.25d in June), so the drain-then-revert failure mode is further away, though unchanged in kind. If it drains, redeem() reverts — Ondo must liquidate Treasuries (T+1) and refill manually. Emergency pauser is a 1-of-9 Safe (0x2e55b738…A2CC — any single signer freezes redemptions; the prior review said 1-of-8). Exit if USDC pool < $10M without refill within 48h, or if the global limit is cut. | On-chain rate limiter + pool balance (2026-07-21); Ondo docs. Ondo positions instant redemption as the headline UX; we add it has never been stress-tested at current AUM, and the holder concentration makes a single exit dominate the shared limit. |
| 5 | Issuer entity restructure, BVI jurisdiction | Ondo USDY LLC was folded into Ondo Global Markets (BVI) Limited in Dec 2025. Ankura attestations still reference the original 2023 trust agreement; legal continuity of the holder security interest through the restructure is assumed, not independently opined. Reg S non-US-only exemption — if SEC challenges or reclassifies, secondary liquidity evaporates for affected holders. Exit if regulators open inquiry or if another entity restructure occurs without holder notice. | Ondo docs. No external legal opinion published on the OGM restructure; we flag this as unverified. |
| 6 | LayerZero bridge surface + weak ancillary multisigs | LayerZero V2 OFT adapter (0xa6275720b3fB1Efe3E6EF2b5BF2293148852307D) holds MINTER_ROLE on USDY across 11 chains and carries heavy traffic — the Ethereum supply swung 160M↔967M in May 2026 on bridge flows alone. Current DVN config is strong (4-of-4 required on Arb/Sol, 3-of-3 on Mantle), but the 4/7 Safe can reconfigure DVNs to a weaker setup with no delay. Residual surface: zero-day in LZ Endpoint/MessageLib, or coordinated compromise of all 4 DVN operators. Separately, the blocklist owner is a 1/2 Safe and can restrict any address with no delay. Correction: the sanctions list (0x40C5…AC8fb) is the Chainalysis sanctions oracle, owned by Chainalysis’s own key (0xDF90…36CD) — not an Ondo-controlled lever, as the prior review implied. Exit if DVN config is weakened or if blocklist ownership changes without notice. | Sanctions-oracle name() + owner() read on-chain 2026-07-21. DVN config via SendLib302/ReceiveLib302 (2026-05-11, carried forward, not re-verified); Ondo addresses. Industry context: rsETH exploit Apr 2026 ($292M) exploited 1-of-1 DVNs — Ondo’s current config is not vulnerable to that pattern, but the admin can downgrade it. |
Key-compromise threshold
No privileged action is timelocked (getModulesPaginated() = [] on the admin Safe), and one 4/7 Safe carries an unusually wide blast radius.
- Funds (mispriced mint/redeem, unbacked mint): 3 of 5 — lower than the 4-of-7 the prior review stated. A separate 3-of-5 Safe (
0x5AE21c99…78eF,getThreshold()= 3 of 5 owners, verified 2026-07-21) administers the oracle wrapper layer thatInstantManageractually reads, so the cheapest mispriced-mint path does not go through the 4/7 at all. Independently, the 4/7 admin Safe holdsMINTER_ROLEon USDY directly (hasRole= true) — unbacked mint needs no ProxyAdmin upgrade, contrary to the prior framing — and it also holds the oracle’sDEFAULT_ADMIN_ROLE(overrideRange()), the ProxyAdmin, and OFT/DVN control. No timelock on any of it. - Liveness (freeze / forced exit): single point of failure.
PAUSER_ROLEhas two members: the 4/7 admin Safe and0x2e55b738…A2CC, which is 1-of-9 (not the 1-of-8 previously stated) — any one of those nine signers pauses transfers and redemptions. The blocklist is a 1/2 Safe. Redemption also halts naturally if the $30.6M USDC pool drains. - Single point of failure: yes for liveness (any one of the nine 1-of-9 pauser signers). Funds require 3-of-5, with no timelock anywhere — a materially lower bar than the eval previously claimed, and the 4/7’s direct
MINTER_ROLEmeans a second, equally instant path exists. - Not an Ondo key: the sanctions list (
0x40C5…AC8fb) is the Chainalysis sanctions oracle (name()= “Chainalysis sanctions oracle”), and0xDF90…36CDis Chainalysis’s operator key, not Ondo’s. The prior review read this as single-key Ondo control over our address; that was wrong — the exposure is to Chainalysis’s list, which is industry-standard.
Liquidity & exit
Primary exit is InstantManager.redeem(rwaAmount, USDC, minOut) → atomic single-tx burn-and-receive USDC, zero fees (defaultFee flat=0, bps=0, 2026-05-11). Backup is a bank-wire redemption with OGM BVI for amounts >$100K, manual, T+1+ on Treasury liquidation. Secondary DEX liquidity is thin — small Orca pool on Solana, Camelot on Arbitrum, Agni on Mantle, no meaningful Ethereum DEX depth — not a reliable exit at size. Worst-case latency under stress: the USDC pool drains in 2.0d at max global rate, then $1.11B, but bridge-transient — ranged 160M–967M in May 2026); rate limits redeem() reverts until Ondo refills (T+1 minimum); the admin or 1/8 emergency pauser can halt redemptions outright at any time. Key dated reads (2026-07-21, block 25,582,684): USDC.balanceOf(0x3312…8fa5) = ~$30.61M; RWADynamicOracle.getPrice() = $1.140159; USDY.totalSupply() (ETH) = 969,566,371 ($15M/24h global + $10M/24h per-user, both re-verified on-chain this pass.
Defensible size at current liquidity (post-haircut): $10M. Math: per-user limit is $10M/day; global limit is $15M/day shared. Under stress assume our share of global capacity is halved by peer redeemers → ~$5M/day effective throughput. Steady state, $10M exits in 1d; 3× haircut → ~2–3d. A $30M position would take ~6d, approaching the 7d threshold with no margin. Hold at $10M — the pool refill to ~$30.6M (~2.0d of capacity, up from ~1.25d) removes the tightest constraint but not the binding one, which is the $15M/day global limit shared with concentrated peers. Sizing is set by redemption throughput, not by the bridge-transient Ethereum supply.
Stress scenario: NOCA exits 50% of a $10M position in 7d while peers also exit. Day 1–2: queue for the $15M/day global slot against concentrated peers (a single institutional holder exit dwarfs the limit); assume $5M/day effective → $5M Day 1, $5M Day 2 if the USDC pool holds. The ~$30.6M pool drains in ~2.0d at max rate, after which redeem() reverts until Ondo refills from Treasury liquidation (T+1 → Day 3–4). Risk that the 1-of-9 emergency Safe pauses redemptions outright during the stress; in that case the bank-wire path via OGM BVI is the only exit, timeline indeterminate. Pre-requisite for any of this: KYC enrollment in OndoIDRegistry completed before deployment, not during a crisis.
External reviews
Source links for the third-party takes in the Risks table. Independent risk coverage is thin — most third-party work here is audit-focused, not risk assessment. Per rubric.md, reviews older than 90d (⚠️) are stale — refresh before relying.
- Hindenrank — safety rating (C+, 39/100) · 2026-04-21 · ⚠️ stale (91d)
- LlamaRisk — USDY asset overview (no score) · 2023-10-02 · ⚠️ stale, predates the OGM restructure
- Ondo security audits — Spearbit/Cantina, Halborn, Cyfrin, Code4rena, Nethermind · audit library
- Ankura Trust — verification-agent attestations (monthly + daily); not public, held in source materials.