Wormhole Foundation EVM-NTT Audit Report
Cyfrin reviewed Wormhole (Wormhole Foundation EVM-NTT Audit Report) on 11 Apr 2024: 15 findings, 0 critical; 10 marked fixed, 5 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings15
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 3 | 5 |
| Low | 0 | 2 | 3 |
HighQueued transfers can become stuck on the source chain if new Transceivers are added or existing Transceivers are modified before completionFixed
The report gives no description here.
HighQueued transfers can become stuck on the source chain if Transceiver instructions are encoded in the incorrect orderFixed
The report gives no description here.
MediumDisabled Transceivers cannot be re-enabled by calling TransceiverRegistry::_setTransceiver after 64 have been registeredFixed
The report gives no description here.
MediumLack of a gas refund in the current design can lead to the overcharging of users and misaligned relayer incentives that can choke message executionFixed
The report gives no description here.
MediumNTT Manager cannot be unpaused once pausedFixed
The report gives no description here.
MediumSetting a peer NttManager contract for the same chain can cause loss of user fundsFixed
The report gives no description here.
MediumSilent overflow in TrimmedAmount::shift could result in rate limiter being bypassedFixed
The report gives no description here.
LowAsymmetry in Transceiver pausing capabilityFixed
The report gives no description here.
LowMissing threshold invariant check when adding/removing transceiversFixed
The report gives no description here.
LowWormholeTransceiver EVM chain IDs storage cannot be updatedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Wormhole’s security record
WormholeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us