Skip to content
#05 largest Input validation 2022

The Wormhole hack — $326M lost

Loss$326M
Date2 Feb 2022
ChainSolana ↔ Ethereum
Failure classInput validation
In assets120,000 wETH minted from nothing
Targettoken bridge
1

What happened

On Solana, a program proves that the signature-verification precompile ran by reading the Instructions sysvar. Wormhole read it with the deprecated load_instruction_at, which parses whatever account you hand it and does not check that the account is the real sysvar. The attacker supplied his own account, containing a fabricated record saying "Secp256k1 verified these signatures," and the bridge accepted a guardian message it had never verified — minting 120,000 wETH on Solana with zero ETH behind it.

2

How the attack ran

  1. Build a fake guardian messageNo real signatures behind it
  2. Pass your own accountIn the slot where the Instructions sysvar belongs
  3. load_instruction_at trusts itIt parses the data without checking the account’s address
  4. Minted from nothing120,000 wETH on Solana, no ETH locked
3

The code

solana/bridge/program/src/api/verify_signature.rs
// ❌ BEFORE — trusts whatever account sits in the "instructions" slot
let secp_ix = solana_program::sysvar::instructions::load_instruction_at(
    secp_ix_index as usize,
    &accs.instruction_acc.try_borrow_mut_data()?,   // ← ANY account works
)?;

// ✅ AFTER — the checked variant verifies the address for you
let secp_ix = solana_program::sysvar::instructions::load_instruction_at_checked(
    secp_ix_index as usize,
    &accs.instruction_acc,   // must == Sysvar1nstructions1111111111111111111111111
)?;
4

What would have caught it

What an audit looks for: on Solana, every account passed into an instruction is attacker-controlled until the program proves otherwise. Owner checks, address checks, signer checks. "It came in the sysvar position" is not a check — this is still the number-one bug class on the chain.
6

Sources

Every figure on this page comes from the post-mortems above, not from us. Losses are US dollars at the time of the incident.

Check your own contract for this

Input validation is one of the 203 classes the SaferICO scanner checks for. It will not review your signing process — but it will read your Solidity.

Run the scanner See how it is attacked Read the docs