Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wormhole-foundation/wormhole

              main @ e2c8b7d
            

137

Fixes

CVEs

CRITICAL

Peak severity

51.5%

Coverage

Highlights

Auth Bypass: 41 prior fixes. Scrutinize any change in this area.

terra/contracts/token-bridge/src/contract.rs: most-fixed (11 issues). Treat as high-risk during review.

101 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Guardian signatures on Solana could be reused or duplicated due to a failure to enforce strictly ascending signature indices, allowing a subset of guardians to reach a quorum. This is mirrored in other smart contract environments.

Signature Verification Bypass: The signature validation function would succeed on empty signature lists due to a trivially successful loop over zero elements, bypassing core bridge authentication.

Auth Bypass: A validation routine printed an error message log indicating a program account mismatch but failed to return an error code, allowing unauthorized operations to execute successfully.