Wormhole security record
As of 20 Oct 2026, Wormhole has 11 audit reports by 4 security firms on Trustblock; the latest is by Cyfrin, dated 4 Oct 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits11
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Multi-Gov: Cross Chain Governance Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Original removed |
| Wormhole Worldcoin World Id State Root Bridge | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole Foundation EVM-NTT Diff Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Original removed |
| Wormhole Foundation EVM-NTT Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole Foundation EVM-CCTP Integration | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole Thermae Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole Token Translator audit | Security firm: Oak Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Wormhole - Ethereum | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| pyth2wormhole - Governance | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
| pyth2wormhole - Solana | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
| Pyth-client | Security firm: CertiK | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · skynet.certik.com |
Findings83
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 2 | 5 |
| Medium | 1 | 5 | 10 |
| Low | 28 | 13 | 18 |
Marked Gas, Informational, Info or Warning by the firms. Not counted as findings.
InformationalInconsistent inline documentation for errors and eventsWormhole Foundation EVM-NTT Diff Audit Report · Cyfrin · 23 Jul 2024Open
The report gives no description here.
Open the reportInformationalIncorrectly documented error selectorWormhole Foundation EVM-NTT Diff Audit Report · Cyfrin · 23 Jul 2024Open
The report gives no description here.
Open the reportInformationalLack of events for setting inbound and outbound limitsWormhole Foundation EVM-NTT Diff Audit Report · Cyfrin · 23 Jul 2024Open
The report gives no description here.
Open the reportInformationalLack of indexing in TransferSent eventWormhole Foundation EVM-NTT Diff Audit Report · Cyfrin · 23 Jul 2024Open
The report gives no description here.
Open the reportGas_checkProposalEligibility gas optimizationMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalMissing deployment script for HubEvmSpokeAggregateProposerMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalMissing implementation to cast fractional vote with signatureMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalPotential long-term failure in HubGovernor::getVotes due to uint32 Casting of TimestampsMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Acknowledged
The report gives no description here.
Open the reportInfoSignature Malleability due to accepting S values with high and also low orderWormhole Worldcoin World Id State Root Bridge · Ackee Blockchain Security · 1 Oct 2024Acknowledged
The report gives no description here.
Open the reportInformationalCanonical NTT chain ID should be fetched directly from Wormhole or mapped accordinglyWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalIncorrect topics[0] documented in INTTManagerEvents and IRateLimiterEventsWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportInformationalNatSpec documentation inconsistent with function/event signaturesWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportGasOptimize invariant check iterations in TransceiverRegistry::_check- TransceiversInvariantsWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportInformationalUnchained initializers should be called in PausableOwnable::__PausedOwnable_init insteadWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportGasUnnecessary stack variable in Governance::encodeGeneralPurposeGovernanceMessageWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportGasUnnecessary type casts of proxied storage slots from bytes32 to uint256Wormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Acknowledged
The report gives no description here.
Open the reportInformationalCalldata restriction on Wormhole payload should not be modifiedWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportInformationalPotential accounting error when the decimals of bridged assets differ between CCTP domainsWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportInformationalPotential dangers for inheriting applications executing the Wormhole payloadWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportInformationalSequencing considerations should be clearly documented and communicated to integratorsWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalTemporary denial-of-service when in-flight messages are not executed before a deprecated Wormhole Guardian set expiresWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportInformationalThe mintRecipient address should be required to indicate interface support to prevent potential loss of fundsWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Acknowledged
The report gives no description here.
Open the reportInformationalMissing attributes on some message handlers’ responsesWormhole Token Translator audit · Oak Security · 6 Jul 2023Acknowledged
The report gives no description here.
Open the reportInformationalRedundant check on the submessage replyWormhole Token Translator audit · Oak Security · 6 Jul 2023Acknowledged
The report gives no description here.
Open the reportInformationalUnhandled zero-amount transferWormhole Token Translator audit · Oak Security · 6 Jul 2023Acknowledged
The report gives no description here.
Open the reportInformationalUnused WORMHOLE_CONTRACT storage variableWormhole Token Translator audit · Oak Security · 6 Jul 2023Acknowledged
The report gives no description here.
Open the reportGasHash comparison can be optimizedMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalInconsistent documentation related to the deployment of SpokeMessage- ExecutorMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalMissing event emissions when changing critical parametersMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalProposal deadline extension is allowed even in Pending stateMulti-Gov: Cross Chain Governance Audit Report · Cyfrin · 4 Oct 2024Fixed
The report gives no description here.
Open the reportShow 10 more
WarningPossible ReinitializationWormhole Worldcoin World Id State Root Bridge · Ackee Blockchain Security · 1 Oct 2024Fixed
The report gives no description here.
Open the reportInformationalMultiple staticcall success booleans are not checkedWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Fixed
The report gives no description here.
Open the reportGasOptimize the TrimmedAmount struct as a bit-packed uint72 user-defined typeWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Fixed
The report gives no description here.
Open the reportInformationalUnused PausableUpgradeable::CannotRenounceWhilePaused error should be removedWormhole Foundation EVM-NTT Audit Report · Cyfrin · 11 Apr 2024Fixed
The report gives no description here.
Open the reportInformationalSetup unnecessarily inherits OpenZeppelin ContextWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Fixed
The report gives no description here.
Open the reportInformationalUse SafeERC20::safeIncreaseAllowance in the place of IERC20::approve in WormholeCctpTokenMessenger::setTokenMessengerApprovalWormhole Foundation EVM-CCTP Integration · Cyfrin · 9 Apr 2024Fixed
The report gives no description here.
Open the reportGasDon’t initialize variables with default valueWormhole Thermae Audit Report · Cyfrin · 10 Jan 2024Fixed
The report gives no description here.
Open the reportGasFail fast in _completeTransfer by checking for incorrect address/chainId immediately after calling TOKENBRIDGE.parseTransferWithPayloadWormhole Thermae Audit Report · Cyfrin · 10 Jan 2024Fixed
The report gives no description here.
Open the reportInformationalMissing sanity check for address validity in PorticoBase::unpadAddressWormhole Thermae Audit Report · Cyfrin · 10 Jan 2024Fixed
The report gives no description here.
Open the reportInformationalMove payable receive() function from PorticoBase into PorticoFinishWormhole Thermae Audit Report · Cyfrin · 10 Jan 2024Fixed
The report gives no description here.
Open the reportShow 4 more
InformationalPortico::start not used internally could be marked externalWormhole Thermae Audit Report · Cyfrin · 10 Jan 2024Fixed
The report gives no description here.
Open the reportInformationalRemove unused codeWormhole Thermae Audit Report · Cyfrin · 10 Jan 2024Fixed
The report gives no description here.
Open the reportInformationalTokenBridge::isDeployed could be declared pureWormhole Thermae Audit Report · Cyfrin · 10 Jan 2024Fixed
The report gives no description here.
Open the reportGasUse custom errors instead of revert error stringsWormhole Thermae Audit Report · Cyfrin · 10 Jan 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="wormhole"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us