Wormhole Governor and Watchers
Audit · firm’s term: Security Assessment
Trail of Bits reviewed Wormhole (Wormhole Governor and Watchers) on 7 Apr 2023: 7 findings, 0 critical; none marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings17
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 7 | 0 | 0 |
Marked Informational by the firm. Not counted as findings.
Informationalevm.Watcher.Run’s default behavior could hide bugs PatchingOpen
The report gives no description here.
InformationalFields protected by mutex are not documented PatchingOpen
The report gives no description here.
InformationalFinalizer is allowed to be nil Data ValidationOpen
The report gives no description here.
InformationalGovernor relies on a single external source of truth for asset prices Data ValidationOpen
The report gives no description here.
InformationalLack of doc comments PatchingOpen
The report gives no description here.
InformationalPotential resource leak Denial of ServiceOpen
The report gives no description here.
InformationalRace condition in TestBlockPoller TimingOpen
The report gives no description here.
InformationalUnconventional test structure TestingOpen
The report gives no description here.
InformationalWatcher configuration is overly complex Data ValidationOpen
The report gives no description here.
InformationalWormhole node does not build with latest Go version PatchingOpen
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Wormhole’s security record
WormholeSecurity firm
Trail of Bits29 projects reviewed · 47 reports · latest Sep 2026
See Trail of Bits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us