2023 Ⓒ Wormhole. All Rights Reserved.
Wormhole gets stronger, safer, and more secure every day
Wormhole didn’t become one of the longest-standing interoperability protocols without experiencing setbacks. That’s the expected cost of trailblazing. It’s how you react to those setbacks that matter. The hack of early 2022 propelled Wormhole forward, unlocking a flurry of innovation to fortify the protocol. Today, Wormhole has one of the best security programs in all of Web3.
The Guardians
Before any Wormhole transaction can be completed, it must pass through multiple Guardians, each of whom conducts their own independent validation process prior to verifying and validating that transaction.
Rigorous auditing
Wormhole contributors perform internal audits of new features and capabilities. In addition to internal audits, third-party audit firms are contracted to perform external audits that serve two primary goals:
Discover bugs missed in internal audits
Provide transparency and confidence for users
| January 2022 | Neodyme | Ethereum Contracts | Report available |
| January 2022 | Neodyme | Solana Contracts | Report available |
| January 2022 | Neodyme | Terra Contracts | Report available |
| January 2022 | Neodyme | Guardian | Report available |
| January 2022 | Neodyme | Solitaire | Report available |
| July 2022 | Kudelski | Ethereum Contracts | Report available |
| July 2022 | Kudelski | Solana Contracts | Report available |
| July 2022 | Kudelski | Terra Contracts | Report available |
| July 2022 | Kudelski | Guardian | Report available |
| August 2022 | Kudelski | Algorand Contracts | Report available |
| September 2022 | OtterSec | NEAR Contracts | Report available |
| September 2022 | Trail of Bits | Solana Contracts | Report available |
| September 2022 | Trail of Bits | CosmWasm Contracts | Report available |
| October 2022 | OtterSec | Aptos Contracts | Report available |
| October 2022 | Hacken | NEAR Integration | Report available |
| November 2022 | Zellic | Aptos Integration | Report available |
| Q4 2022 | Halborn | Wormchain | Draft |
| Q4 2022 | Halborn | Accounting | Draft |
| Q4 2022 | Certik | Ethereum Contracts | Draft |
| Q4 2022 | Certik | Solana Contracts | Draft |
| Q4 2022 | Certik | Terra Contracts | Draft |
| Q4 2022 | Certik | Guardian | Draft |
| Q4 2022 | Certik | Solitaire | Draft |
| Q4 2022 | Coinspect | Algorand Contracts | Scheduled |
| Q4 2022 | Hacken | NEAR Contracts | Scheduled |
| Q1 2023 | Trail of Bits | Guardian | Scheduled |
Proven tech
Wormhole runs on the same cryptographic primitives as Ethereum. We implement a multi-sig approach, whereby 19 Guardians - via a proof of authority of their private key - independently sign messages but largely distrust each other. Guardians are spread across the globe, and each has their own operational security requirements, making it nearly impossible to compromise.
Transactions require 2/3+ consensus
Upgrades require 2/3+ consensus
Always open source
Building in the open hardens you in a way that nothing else does. We believe in the power of transparency and community and have been proudly sharing our progress, patterns, and process since July, 2020. It is open to any and everyone to contribute and improve upon.
Bug bounty program
Bug bounty programs and the white-hat community at large are a strategic value add to our internal security program. This program allows any motivated white-hat in the world to review our code and receive multi-million-dollar incentives - including the hightest single payout in the industry - to responsibly report critical bugs in Wormhole.
.Learn more
Safety features
The Governor allows Wormhole Guardians to provide optional value movement protections to token bridges built on Wormhole. This protection allows Wormhole Guardians to govern (or effectively rate-limit) the notional flow of assets from any given token bridge chain.
This safety feature allows Guardians to limit the impact of any security issue any given chain may have from affecting other connected chains. The Governor allows the setting of daily limits of notional flow and also has an ability to set a fixed finality delay for transactions over a specific size for each supported chain.
.Whitepaper.Configuration exampleJoin our growing security team
Want to help make Wormhole the most secure interoperability protocol in the world?
.Join our team
Social media monitoring
The Wormhole project maintains a social media monitoring program to stay abreast of important ecosystem developments. These developments include monitoring services like Twitter for key phrases and patterns such that the Wormhole project may be informed of a compromise or vulnerability in a dependency that could negatively affect Wormhole, its users, or the chains that Wormhole is connected to. In the case of a large ecosystem development that requires response, the Wormhole project will engage its security incident response program.