Wormhole Foundation EVM-CCTP Integration

CyfrinCode version: not recorded (see the report)

Cyfrin reviewed Wormhole (Wormhole Foundation EVM-CCTP Integration) on 9 Apr 2024: 5 findings, 0 critical; all acknowledged, none fixed.

No open critical findings
Open the reportOpen Wormhole’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium020
Low030

Marked Informational by the firm. Not counted as findings.

InformationalCalldata restriction on Wormhole payload should not be modifiedAcknowledged

The report gives no description here.

InformationalPotential accounting error when the decimals of bridged assets differ between CCTP domainsAcknowledged

The report gives no description here.

InformationalPotential dangers for inheriting applications executing the Wormhole payloadAcknowledged

The report gives no description here.

InformationalSequencing considerations should be clearly documented and communicated to integratorsAcknowledged

The report gives no description here.

InformationalTemporary denial-of-service when in-flight messages are not executed before a deprecated Wormhole Guardian set expiresAcknowledged

The report gives no description here.

InformationalThe mintRecipient address should be required to indicate interface support to prevent potential loss of fundsAcknowledged

The report gives no description here.

InformationalSetup unnecessarily inherits OpenZeppelin ContextFixed

The report gives no description here.

InformationalUse SafeERC20::safeIncreaseAllowance in the place of IERC20::approve in WormholeCctpTokenMessenger::setTokenMessengerApprovalFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Wormhole’s security record

Wormhole
Audits11 audits by 4 firmsLast audit Oct 2024, by Cyfrin.
Critical findingsNo open critical findingsAcross 11 reports.
Open Wormhole’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us