Wormhole Foundation EVM-CCTP Integration

Cyfrin9 Apr 2024Code version: not recorded (see the report)

Cyfrin reviewed Wormhole (Wormhole Foundation EVM-CCTP Integration) on 9 Apr 2024: 5 findings, 0 critical; all acknowledged, none fixed.

No open critical findings

Open the report Open Wormhole’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	2	0
Low	0	3	0

MediumLoss of funds due to malicious forcing of mintRecipient onto Circle blacklist when CCTP message is in-flightAcknowledged

The report gives no description here.

MediumRedemptions are blocked when L2 sequencers are downAcknowledged

The report gives no description here.

LowA given CCTP domain can be registered for multiple foreign chains due to insufficient validation in Governance::registerEmitterAndDomainAcknowledged

The report gives no description here.

LowLack of Governance action to update registered emittersAcknowledged

The report gives no description here.

LowPotentially dangerous out-of-bounds memory access in BytesParsing::sliceUncheckedAcknowledged

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Wormhole’s security record

Wormhole

Audits11 audits by 4 firmsLast audit Oct 2024, by Cyfrin.

Critical findingsNo open critical findingsAcross 11 reports.

Open Wormhole’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.