Wormhole security record
As of 20 Oct 2026, Wormhole has 11 audit reports by 4 security firms on Trustblock; the latest is by Cyfrin, dated 4 Oct 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits11
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Multi-Gov: Cross Chain Governance Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Original removed |
| Wormhole Worldcoin World Id State Root Bridge | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole Foundation EVM-NTT Diff Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Original removed |
| Wormhole Foundation EVM-NTT Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole Foundation EVM-CCTP Integration | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole Thermae Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole Token Translator audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole - Ethereum | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| pyth2wormhole - Governance | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
| pyth2wormhole - Solana | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
| Pyth-client | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
Findings83
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 2 | 5 |
| Medium | 1 | 5 | 10 |
| Low | 28 | 13 | 18 |
HighCentralization Related RisksPyth-client · CertiK · 30 Nov 2022Acknowledged
The owner of the private key from the `mapping` account has the ability to add the next account in the chain, as well as adding accounts of products, prices, and as a consequence, add and delete publishers. This allows the owner of the private key to fully control the data provided by oracle for its customers, which creates a risk of centralization in case of compromise.
Open the reportHighUpgradable Program Centralization RiskPyth-client · CertiK · 30 Nov 2022Acknowledged
A Solana program can be deployed on the mainnet as: * final: the code cannot be updated. * upgradable: `BPFLoaderUpgradeable` needs to be set as the program owner and an `upgrade authority`, which is a user account, is given. In case the `Pyth` program is deployed as upgradable, the `upgrade authority` has the privilege to update the implementation of the program at his/her will. Any compromise to the `upgrade authority` account may allow a hacker to take advantage of this authority and control the implementation of the program and therefore execute potential malicious functionalities in the program.
Open the reportMediumAccess-controlled functions cannot be called when L2 sequencers are downWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumImmutable gas limit within WormholeTransceiver can lead to execution failures on the target chainWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumTransceiver invariants and ownership synchronicity can be broken by unsafe Transceiver upgradesWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumLoss of funds due to malicious forcing of mintRecipient onto Circle blacklist when CCTP message is in-flightWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportMediumRedemptions are blocked when L2 sequencers are downWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowCross-Chain votes can be invalidated in some scenarios due to Hub- Spoke timestamp mismatchMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowLack of limits of vote weight window can lead to unfair voting power estimationMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowLack of minimum threshold for maxQueryTimestampOffset in HubEvm- SpokeAggregateProposerMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowLack of zero address checks at multiple placesMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowPotential de-synchronization of spoke registries between HubVotePool and HubEvmSpokeAggregateProposerMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowInconsistent implementation of ERC-7201 Namespaced Storage locationsWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowIncorrect Transceiver payload prefix definitionWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowA given CCTP domain can be registered for multiple foreign chains due to insufficient validation in Governance::registerEmitterAndDomainWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowLack of Governance action to update registered emittersWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowPotentially dangerous out-of-bounds memory access in BytesParsing::sliceUncheckedWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportLowContracts are not compliant with the CW2 Migration specificationWormhole Token Translator audit · Oak Security · 6 Jul 2023Acknowledged
The report gives no description here.
Open the reportLowLack of configuration parameter validationWormhole Token Translator audit · Oak Security · 6 Jul 2023Acknowledged
The report gives no description here.
Open the reportLowTruncated CW20 token transfer amount for CW20 tokens with more than 8 decimalsWormhole Token Translator audit · Oak Security · 6 Jul 2023Acknowledged
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="wormhole"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us