Pyth-client

CertiK30 Nov 2022Code version: not recorded (see the report)

CertiK reviewed Wormhole (Pyth-client) on 30 Nov 2022: 15 findings, 0 critical; 7 marked fixed, 2 acknowledged, 6 open.

No open critical findings

Open the report Open Wormhole’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	2	0
Medium	0	0	1
Low	6	0	6

HighCentralization Related RisksAcknowledged

The owner of the private key from the `mapping` account has the ability to add the next account in the chain, as well as adding accounts of products, prices, and as a consequence, add and delete publishers. This allows the owner of the private key to fully control the data provided by oracle for its customers, which creates a risk of centralization in case of compromise.

HighUpgradable Program Centralization RiskAcknowledged

A Solana program can be deployed on the mainnet as: * final: the code cannot be updated. * upgradable: `BPFLoaderUpgradeable` needs to be set as the program owner and an `upgrade authority`, which is a user account, is given. In case the `Pyth` program is deployed as upgradable, the `upgrade authority` has the privilege to update the implementation of the program at his/her will. Any compromise to the `upgrade authority` account may allow a hacker to take advantage of this authority and control the implementation of the program and therefore execute potential malicious functionalities in the program.