Wormhole Hack

The Wormhole hack exploited a critical vulnerability in the bridge's signature verification process on the Solana side. The core issue was that an earlier version of the code had proper signature verification, but a later update failed to validate signatures in certain circumstances.

The vulnerability was in the verify_signatures function that was supposed to check the Guardian signatures:

// Pseudo-code of the vulnerable function
pub fn verify_signatures(
    &self,
    vaa: &VAA,
    signatures: &[SignatureSet],
) -> Result<()> {
    // ... some code omitted for brevity

    // Critical vulnerability: This check was missing
    // if !verify_signatures_and_quorum(...) {
    //     return Err(InvalidSignature.into());
    // }

    // ... some code omitted for brevity
    Ok(())
}

The attacker exploited this by:

1. Creating a transaction that forged a message claiming to have deposited ETH
2. Bypassing the signature verification that should have confirmed the deposit
3. Minting new wETH tokens on Solana without providing actual ETH on Ethereum
4. Bridging the fraudulently minted wETH back to Ethereum and cashing out