RIADeFi
Refusal file · other

Why Ketju rejected Portal Bridge (Wormhole)

Memo v1Published by Ketju Research

A registry memo, published verbatim and versioned. Superseded versions are recorded, never edited away. A rejection is a judgment for Ketju's client base and thesis, not a universal safety claim. Not investment, legal, tax, or compliance advice.

The memo

REJECTED. Portal is the token-bridging application built on Wormhole's messaging protocol, secured by a 19-node Guardian network requiring 13-of-19 signatures to attest a transfer. On 2022-02-02, a Solana program signature-verification flaw let an attacker forge a Guardian attestation and mint 120,000 wETH, about $325M, with no real backing — one of the largest bridge hacks on record. The loss was made whole only because Jump Crypto, a Wormhole backer, recapitalized the bridge within days and later clawed back further funds through an extraordinary counter-exploit; that is not a repeatable institutional guarantee, and this registry does not treat an informal backer bailout as a substitute for the protocol's own controls being sufficient standalone. Post-incident additions — a Global Accountant that cross-checks minted supply against locked collateral, and a Governor that rate-limits and can hold large transfers for up to 24 hours — are real structural improvements and the incident-free record since 2022 is genuine, but they narrow the risk rather than eliminate the signature-forgery exposure class this bridge design remains inherently subject to.

What would reopen the file

  • Current Guardian-set composition and the specific authority controlling Guardian-set changes are independently confirmed
  • Twelve consecutive months with no Guardian-quorum forgery or signature-verification incident, counted from this review's date
  • The Global Accountant and Governor are confirmed live and correctly configured for the specific chain and asset pair a Ketju position would use
  • A proposed-size redemption is demonstrated to clear within a documented maximum time, including the Governor's worst-case 24-hour hold

Facts on file

Verdict
Rejected
Exposure
other
Chains examined
Ethereum
Memo version
v1
Reviewed
Next review

← All published refusals