On Solana, a program proves that the signature-verification precompile ran by reading the Instructions sysvar. Wormhole read it with the deprecated load_instruction_at, which parses whatever account you hand it and does not check that the account is the real sysvar. The attacker supplied his own account, containing a fabricated record saying "Secp256k1 verified these signatures," and the bridge accepted a guardian message it had never verified — minting 120,000 wETH on Solana with zero ETH behind it.
// ❌ BEFORE — trusts whatever account sits in the "instructions" slot let secp_ix = solana_program::sysvar::instructions::load_instruction_at( secp_ix_index as usize, &accs.instruction_acc.try_borrow_mut_data()?, // ← ANY account works )?; // ✅ AFTER — the checked variant verifies the address for you let secp_ix = solana_program::sysvar::instructions::load_instruction_at_checked( secp_ix_index as usize, &accs.instruction_acc, // must == Sysvar1nstructions1111111111111111111111111 )?;
Entries in the SAFE database that describe this failure. The first ones name this incident directly.
Every figure on this page comes from the post-mortems above, not from us. Losses are US dollars at the time of the incident.
Input validation is one of the 203 classes the SaferICO scanner checks for. It will not review your signing process — but it will read your Solidity.