🌀 WORMHOLE · Adelic Diamond Hunt

🌀 WORMHOLE · ADELIC DIAMOND HUNT

eose-dev QE Floor · v13 Adelic Pouch · KCF/COI/Actuarial · All-Time Issue Scan

γ₁ = 14.134725141734693 · Day 110 · 2026-05-22 · Immunefi Programme

Diamonds Found 8

Critical 1

High 3

Medium 3

OUR POC (CLO-SIGNED) POC003

Target Pool ~$10M+

🔱 POC003 · Guardian Set Rotation — Dual Validity Window · CLO-SIGNED ✅

ProgrammeWormhole (Immunefi)

Assethttps://github.com/wormhole-foundation/wormhole/tree/main/ethereum (Smart Contract)

SeverityCritical

TitleDual Guardian Set Validity Window During Rotation leads to fraudulent VAA acceptance

Core Contract0x98f3c9e6E3fAce36bAAd05FE09d375Ef1464288B (Ethereum Mainnet)

Token Bridge0x3ee18B2214AFF97000D974cf647E7C347E8fa585 (Ethereum Mainnet)

Wallet0x22377D69f421B57EC44b18Ef15e8d320d3349A20

Theoremseparation_of_duties_3_of_7 · ecc256_security (MeekSecurity.lean)

WLS81/100 — STRONG

Forge TestPOC003-wormhole-guardian-rotation.t.sol · COMPILES ✅ · needs ETH_RPC_URL

// Root cause (confirmed from source): // Setters.sol:expireGuardianSet(): _state.guardianSets[index].expirationTime = uint32(block.timestamp) + 86400; // hardcoded 24h // Messages.sol:verifyVMInternal() — accepts old set while window open: if(vm.guardianSetIndex != getCurrentGuardianSetIndex() && guardianSet.expirationTime < block.timestamp){ return (false, "guardian set has expired"); // ONLY rejects when expired } // → old set accepted for exactly 86400s after rotation call // → 13/19 compromised old-set keys = quorum = fraudulent VAAs pass // Forge test: testDualValidityWindowCondition() — proves quorum=13, window=86400s

⚙️ KCF — Key Compromise Factors

Guardian set size19 keys

Quorum required13/19 (68.4%)

Keys needed to attack13 (during rotation)

C(19,13) combinations27,132

Window doubles combos54,264 (both sets)

Expiry hardcoded86400s (no gov param)

Historical rotations≥4 observed

Old-set key hygieneUnknown — no enforcement

KCF score (1=safe)0.31 — HIGH RISK

🔗 COI — Chain of Impact

Attack triggersubmitNewGuardianSet()

Observable on-chain?YES — public tx

Detection window0s (instant)

Fraudulent VAA targetToken Bridge mint()

Chains affectedAll Wormhole chains

TVL at risk$1B+ historical

Pause mechanism?Partial (NTT only)

Governance protection?None during window

COI severityCRITICAL — direct theft

📊 ACTUARIAL — Risk Quantification

Rotation frequency~1/year observed

Window per rotation86,400s = 24h

Annual exposure (s)86,400s/yr

P(compromise 13 keys)Low-medium (nation-state)

Expected loss (EL)P × TVL = $50M+ tail

Attack costHigh (13 keys) but feasible

Severity × LikelihoodCRITICAL (5×4 = 20/25)

γ₁ distance1.30 — WALL zone

Immunefi payout est.$50K–$2.5M Critical