Summary
Ketju does not approve Portal (Wormhole's token bridge): in 2022 an attacker forged a Guardian attestation and minted $325M of unbacked wETH. The design that failed, one validator set signing with no independent second check, is still the core of the bridge. Portal is the token-bridging application built on Wormhole's messaging protocol. A network of 19 Guardian nodes secures it, and 13 of the 19 must sign to attest a transfer. Holders were made whole only because Jump Crypto, a Wormhole backer, refilled the bridge within days and later recovered more funds through an unusual counter-exploit. A backer's informal bailout is not a guarantee anyone can repeat, and Ketju does not count it in place of controls that protect the protocol on their own. Wormhole has since added a Global Accountant and a Governor, and it has had no incident since 2022. These changes narrow the risk of signature forgery without removing it.
Review triggers
- The current Guardian set and the authority that controls changes to it are independently confirmed
- Twelve months in a row, counted from this memo's review date, with no Guardian-quorum forgery or signature-verification incident
- The Global Accountant and Governor are confirmed live and correctly set for the exact chain and asset pair a Ketju position would use
- A proposed-size redemption is shown to clear within a documented maximum time, including the Governor's worst-case 24-hour hold
Facts
- Verdict
- Not approved
- Type
- Other
- Chains examined
- Ethereum
- Reviewed
- Last confirmed