Agent Wormhole
runningoffcode
- Artifacts
- wormhole-x402, mcp-trade-guard, agent-wormhole, dashboard
- Final artifact verified
- [email protected]
- Review window
- 2026-09-21 → 2026-09-25
- Engagement
- Whitebox review | 83 findings | 7 rounds of remediation verification
Assessment coverage
Categories follow the CertiK Skynet six-category shape. What was in scope for a whitebox code review is assessed; everything else is marked not assessed rather than scored.
83 of 83 findings resolved, every fix proven by execution.
Median time to first fix under 4 hours across 7 rounds. One class needed 6 releases.
Threat model, coverage limits and known evasion rates published in the README, not buried.
No token or on-chain governance in scope.
No token in scope.
Outside a code review.
Coverage & rigor
Fuzz cases by campaign
1,190,703 totalShare of every seeded property-fuzz case, by campaign.
Exploitation environments
- Shipped listen() HTTP verifier, run as its own process
- Real Next dashboard in Docker against a real Postgres
- Real mcp-trade-guard proxy against a recording broker mock
- Real MCP stdio server driven over pipes
- Anvil fork of Arc mainnet at block 21,990,872
Findings
| Severity | Count | Resolved | Withdrawn | Open |
|---|---|---|---|---|
| CRITICAL | 3 | 3 | 0 | 0 |
| HIGH | 28 | 28 | 0 | 0 |
| MEDIUM | 33 | 33 | 0 | 0 |
| LOW | 19 | 18 | 1 | 0 |
| Found during remediation | 1 | 1 | 0 | 0 |
| Total | 84 | 83 | 1 | 0 |
Selected findings
5 of 84 shownA funded mainnet signer could be directed by any GitHub account. The payment-policy engine itself was correct (every ARC-000 to ARC-007 rule enforced under test), but task creation was the real authorization boundary, and signup was open, so the engine enforced a policy the attacker had written. Proven end-to-end on an anvil fork of Arc mainnet through the real OAuth path; no traffic sent to any host the project operates.
A JSON-RPC batch array skipped the guard entirely, because the guard was written against a single JSON-RPC object.
The spend cap was checked against a number the caller supplied rather than one derived from the order.
The metered product was served through Next server actions that omitted the admission checks their API twins enforced, so the same operations were reachable without the gate the API applied.
A registry intended as shared read state was writable by any tenant, letting one tenant alter state other tenants relied on.
Remediation timeline
67 closed, 10 open, 5 partial, 1 withdrawn
Claimed83 of 83 closed
15 closed, 1 was our false positive
Claimed16 closed
Confirmed, 0 of 38 separators evade
Claimedwhitespace evasion closed
Confirmed, address recovery not defeatable
Claimeddestination carve-out closed
Placements closed, class open one step over
Claimedseparator placement closed
Runs closed, class open one step over
Claimedseparator runs closed
Confirmed, class closed at the root
Claimedfragmentation closed
Verification method
Every claim in this scorecard is backed by an executed test, not a code reading.
| Findings proven by running an exploit or a harness | 84 / 84 |
| Every assertion paired with a control that fails when the harness is miswired | yes |
| Fixes re-tested against the published artifact, not the client report | yes |
| Independent reproduction of every client-stated metric | yes |
| False-positive sweep on the final build | 210 honest strings, 0 refused |
| Regression sweep against everything closed in earlier rounds | 0 regressions |
| Deliberate attempts to defeat the final control | 14 attempted, 0 succeeded |
Scope & limitations
Reviewed: a whitebox review of the published packages and their source (wormhole-x402, mcp-trade-guard, agent-wormhole) and the payment and ledger code paths of the dashboard. This covered the x402 guard, the trade guard and the Arc execution rail. 84 files, 13,074 SLOC.
Out of scope: this was a source-code review, not a general infrastructure or live-penetration test. Code paths, files and components not named above, and anything added after the review window, were not assessed. Further review is available as a separate engagement.
A security review reduces risk and does not eliminate it. This scorecard describes the artifacts named above at the versions named above, and says nothing about any later version.