Multi-Gov: Cross Chain Governance Audit Report
Cyfrin reviewed Wormhole (Multi-Gov: Cross Chain Governance Audit Report) on 4 Oct 2024: 9 findings, 0 critical; 4 marked fixed, 5 acknowledged.
No open critical findings
Open Wormhole’s security record
The original report was removed from its address (seen 17 Oct 2026).
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 5 | 4 |
LowCross-Chain votes can be invalidated in some scenarios due to Hub- Spoke timestamp mismatchAcknowledged
The report gives no description here.
LowLack of limits of vote weight window can lead to unfair voting power estimationAcknowledged
The report gives no description here.
LowLack of minimum threshold for maxQueryTimestampOffset in HubEvm- SpokeAggregateProposerAcknowledged
The report gives no description here.
LowLack of zero address checks at multiple placesAcknowledged
The report gives no description here.
LowPotential de-synchronization of spoke registries between HubVotePool and HubEvmSpokeAggregateProposerAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Wormhole’s security record
WormholeAudits11 audits by 4 firmsLast audit Oct 2024, by Cyfrin.
Critical findingsNo open critical findingsAcross 11 reports.
Open Wormhole’s security recordSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us