Pyth-client

CertiKCode version: not recorded (see the report)

CertiK reviewed Wormhole (Pyth-client) on 30 Nov 2022: 15 findings, 0 critical; 7 marked fixed, 2 acknowledged, 6 open.

No open critical findings
Open the reportOpen Wormhole’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High020
Medium001
Low606
MediumLack of Rent ValidationFixed

In connection with the [rent](https://docs.solana.com/developing/programming-model/accounts#rent) for storing data in the network, the new created accounts must have a certain number of lamports on their balance, depending on the amount of data.

Low`i` variable already initialized to 0 before theFixed

In the checks to verify that the publisher is valid, variable `i` is initialized as 0: ```cpp=508 uint32_t i = 0; ``` However at the start of the `for` loop, `i` is set to 0 again which isn't necessary: ```cpp=510 for( i=0; i != pptr->num_; ++i ) { ```

LowIncorrect checks on `data_len`Fixed

In the `oracle.h` file, there are multiple assertions on struct sizes, for example: ```cpp static_assert( sizeof( pc_map_table_t ) == 20536, "" ); ``` As a result `ka->data_len >= dlen` in the functions `valid_signable_account` and `valid_writable_account` should instead be a strict check on size: ```cpp ka->data_len == dlen; ```

LowTest Functions in The Main CodeFixed

The `init_test()` and `upd_test()` functions are used for testing and are in the main application code.

LowTyposFixed

There are multiple typos in the code base, the corrections are as follows: 1. In the file: `sort_stable.c`: "interaction" should be "iteration". 2. In the file: `price_model.h`: "srcatch" should be "scratch". "reducd" should be "reduce". [0,cnt) should be [0,cnt]. 3. In the file: `avg.h`, "implict" should be "implicit". 4. In the file: `prng.h`, "faciliate" should be "facilitate". "alingment" should be "alignment". "occassionally" should be "occasionally". 5. In the file: `oracle.c`, "ssign" should be "sign".

LowUsing `hdr->ver_` Instead of `PC_VERSION`Fixed

The version of `hdr->ver_` is checked in the `dispatch()` function and cannot have a value other than `PC_VERSION`. In this case, it makes sense to use `PC_VERSION` in further logic.

LowWeak argument check in `set_min_pub()`Fixed

The only input validation is a check that sees if the size of the input variables satisfies `prm->data_len`. This check is not rigorous enough and as long as the data size matches, any piece of data can be inputted in the `set_min_pub()` function.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Wormhole’s security record

Wormhole
Audits11 audits by 4 firmsLast audit Oct 2024, by Cyfrin.
Critical findingsNo open critical findingsAcross 11 reports.
Open Wormhole’s security record

Security firm

CertiK

1,044 projects reviewed · 1,393 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us