Wormhole Thermae Audit Report
Cyfrin reviewed Wormhole (Wormhole Thermae Audit Report) on 10 Jan 2024: 4 findings, 0 critical; all marked fixed.
No open critical findings
Open the reportOpen Wormhole’s security record
Report hosted on GitHub.
Trustblock does not review code.
Findings4
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 1 |
HighOn-chain slippage calculation using exchange rate derived from pool.slot0 can be easily manipulatedFixed
The report gives no description here.
MediumChecking bool return of ERC20 approve and transfer breaks protocol for mainnet USDT and similar tokens which don’t return trueFixed
The report gives no description here.
MediumNo precision scaling or minimum received amount check when subtracting relayerFeeAmount can revert due to underflow or return less tokens to user than specifiedFixed
The report gives no description here.
LowUse low level call() to prevent gas griefing attacks when returned data not requiredFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Wormhole’s security record
WormholeAudits11 audits by 4 firmsLast audit Oct 2024, by Cyfrin.
Critical findingsNo open critical findingsAcross 11 reports.
Open Wormhole’s security recordSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us