CertiK, a blockchain security platform, reported discovering a vulnerability in the Wormhole system on the Aptos network that could potentially have led to financial losses amounting to $5 million. The flaw was detected and rectified in a timely manner after notifying the Wormhole team, preventing possible exploitation by malicious actors.
According to CertiK, the issue arose due to incorrect implementation of the public(friend) and entry modifiers in the MOVE programming language. The public(friend) modifier restricted function calls to other functions within the same module or specified external accounts, while the entry modifier allowed the function to be called from any external account.
This configuration enabled attackers to create fictitious transactions that would move tokens between accounts without actually transferring funds. This could allow the Ethereum bridge to issue or unlock tokens without the backing of real deposits on the Aptos side. Ultimately, malicious actors could have caused damage up to $5 million had the vulnerability not been identified and addressed promptly.
CertiK provided a detailed report on the vulnerability in video format, enhancing awareness and attention to security issues within the blockchain community.
