Wormhole: Boundless Transceiver audit report
Project Information
CATEGORY
Smart Contracts, zkVM
NETWORK
Ethereum
WEBSITE
https://wormhole.com/
DESCRIPTION
From Sep. 8, 2025 to Sep. 9, 2025, Wormhole engaged Veridise to conduct a security assessment of their Boundless Transceiver. The security assessment covered smart contracts of Boundless Transceiver, which stores Ethereum beacon chain block roots and verifies that events were emitted on another blockchain. Compared to the previous version, which Veridise previously audited, the new version introduces the Boundless Transceiver, which utilizes Wormhole’s architecture to consume proof of a zkVM execution attesting that an event occurred on another chain. Veridise conducted the assessment over 4 person-days, with 2 security analysts reviewing the project over 2 days. The review strategy involved a tool-assisted analysis of the program source code performed by Veridise security analysts as well as thorough code review.
Audit Report
SCOPE
The scope of this security assessment is limited to the following files:
src/
- BeaconEmitter.sol
- BlockRootOracle.sol
- BoundlessTransceiver.sol
- interfaces/ICommitmentValidator.sol
- lib/Beacon.sol
crates/
- common/src/lib.rs
- zkvm/src/lib.rs
- zkvm/guest/src/main.rs