CertiK reviewed Wormhole (Pyth-client) on 30 Nov 2022: 15 findings, 0 critical; 7 marked fixed, 2 acknowledged, 6 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 6 | 0 | 6 |
In connection with the [rent](https://docs.solana.com/developing/programming-model/accounts#rent) for storing data in the network, the new created accounts must have a certain number of lamports on their balance, depending on the amount of data.
In the checks to verify that the publisher is valid, variable `i` is initialized as 0: ```cpp=508 uint32_t i = 0; ``` However at the start of the `for` loop, `i` is set to 0 again which isn't necessary: ```cpp=510 for( i=0; i != pptr->num_; ++i ) { ```
In the `oracle.h` file, there are multiple assertions on struct sizes, for example: ```cpp static_assert( sizeof( pc_map_table_t ) == 20536, "" ); ``` As a result `ka->data_len >= dlen` in the functions `valid_signable_account` and `valid_writable_account` should instead be a strict check on size: ```cpp ka->data_len == dlen; ```
The `init_test()` and `upd_test()` functions are used for testing and are in the main application code.
There are multiple typos in the code base, the corrections are as follows: 1. In the file: `sort_stable.c`: "interaction" should be "iteration". 2. In the file: `price_model.h`: "srcatch" should be "scratch". "reducd" should be "reduce". [0,cnt) should be [0,cnt]. 3. In the file: `avg.h`, "implict" should be "implicit". 4. In the file: `prng.h`, "faciliate" should be "facilitate". "alingment" should be "alignment". "occassionally" should be "occasionally". 5. In the file: `oracle.c`, "ssign" should be "sign".
The version of `hdr->ver_` is checked in the `dispatch()` function and cannot have a value other than `PC_VERSION`. In this case, it makes sense to use `PC_VERSION` in further logic.
The only input validation is a check that sees if the size of the input variables satisfies `prm->data_len`. This check is not rigorous enough and as long as the data size matches, any piece of data can be inputted in the `set_min_pub()` function.
The report names a repository or files. Open the report to see its scope.
1,044 projects reviewed · 1,393 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us