Wormhole Thermae Audit Report
Cyfrin reviewed Wormhole (Wormhole Thermae Audit Report) on 10 Jan 2024: 4 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings4
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 1 |
Marked Gas or Informational by the firm. Not counted as findings.
GasDon’t initialize variables with default valueFixed
The report gives no description here.
GasFail fast in _completeTransfer by checking for incorrect address/chainId immediately after calling TOKENBRIDGE.parseTransferWithPayloadFixed
The report gives no description here.
InformationalMissing sanity check for address validity in PorticoBase::unpadAddressFixed
The report gives no description here.
InformationalMove payable receive() function from PorticoBase into PorticoFinishFixed
The report gives no description here.
InformationalPortico::start not used internally could be marked externalFixed
The report gives no description here.
InformationalRemove unused codeFixed
The report gives no description here.
InformationalTokenBridge::isDeployed could be declared pureFixed
The report gives no description here.
GasUse custom errors instead of revert error stringsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Wormhole’s security record
WormholeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us