Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
wormhole-foundation/wormhole
main @ 3888993
150
Fixes
0
CVEs
CRITICAL
Peak severity
48.5%
Coverage
Highlights
Auth Bypass: 47 prior fixes. Scrutinize any change in this area.
terra/contracts/token-bridge/src/contract.rs: most-fixed (10 issues). Treat as high-risk during review.
111 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Signature Bypass: The verification system was vulnerable to a critical signature bypass where validated hashes did not match the actual contents of the VM structure, allowing arbitrary message forging.
Auth Bypass: A critical quorum bypass existed where the signature verification logic failed to check signature index uniqueness, allowing an attacker to reuse a single guardian's signature multiple times to satisfy the quorum requirement.
Auth Bypass: Failing to enforce wrapped token metadata validation in complete_wrapped allowed unauthorized minting via forged or unchecked VAAs.