Wormhole: the bridge delivers tokens for funds that have not been deposited

A bridge between blockchains works in part as a deposit and its receipt. Fixed assets on one side allow the issuance of their representation on the other. On February 2, 2022, Wormhole accepted an operation that broke this link: 120,000 ethers represented were created on Solana without equivalent legitimate deposit.

Analyses identify a problem in validating the signatures of the bridge keepers. An operation that has not received the required authorization may appear approved. The attacker then turns an erroneous recognition of the system into assets that he can move or exchange.

A significant portion is then transferred to Ethereum. The damage is estimated to be around $325 million at the time. The figure measures a specific incident; it does not mean that the Ethereum network or the Solana network as a whole has been fully taken care of.

Wormhole interrupts its service and fixes the vulnerability. Jump Crypto then provides 120,000 ethers to restore token coverage. Upgrading the reserves protects the operation of the bridge, but does not mean that the author has voluntarily returned the funds.

Public movements allow specialists to track assets and document operations. The sources selected do not allow to identify with certainty a responsible individual. An observable address remains distinct from a proven civil identity.

The case illustrates the fragility of a promise: a token presented as the representation of an asset depends on the ability of the bridge to verify that the asset actually exists in the right place.