Curriculum·G204 Tools a Non-Developer Can Run·about 29 min
Static analysis output a user can read
By the end of this lesson you can
- →Explain what a static analyzer does: flag classes of known-dangerous patterns in code without running it
- →Explain how the Wormhole bridge lost about 325 million dollars to a deprecated verification function whose fix was already public
- →Compute what a static-analysis report's severity buckets and categories tell a reader who cannot read the code itself
- →Read a static-analysis report for the questions it raises rather than as a verdict, and know its false-positive limits
Graduate · enrolled learners
This lesson opens with Wormhole bridge, 2 February 2022.
- What happened
- Wormhole is a bridge connecting Solana and Ethereum. Its Solana contract verified that a set of trusted guardians had signed off on a transfer, but the check used a deprecated function to load the verifying instruction and failed to confirm that the verification had actually been performed by the real system program. That let the attacker supply a spoofed set of signatures, pass the broken check, and mint 120,000 wrapped ether on Solana, about 325 million dollars, with nothing backing it. A fix for exactly this weakness had already been committed to Wormhole's public code repository but not yet deployed to the live contract, and the attacker struck the still-vulnerable deployment. The flaw was a known-dangerous pattern, an unverified account in a security-critical path, of the class automated tools are built to flag, and the correction to it was public before the loss.
- The decision point
- Wormhole's flaw was not exotic. Using a deprecated function and failing to verify an account in a signature check is a recognized category of mistake, the kind a static analyzer exists to raise, and the fix for it sat in the open repository before the attack. The user's tool here is static analysis: automated scanners that read code and flag classes of known-dangerous patterns without running it, producing a report of findings sorted by severity and category. A non-developer cannot judge every finding, but they can read the report's shape, whether the security-critical categories are clean, whether high-severity items are present and addressed, and they can ask whether a flagged pattern was fixed and deployed or, as at Wormhole, merely fixed in public and left live. The report raises the questions; it does not answer them, and reading it that way is the skill.
- Recorded loss
- $325,000,000
What you will be able to answer
- →What flaw did the Wormhole exploit rely on?
- →What was notable about the Wormhole fix?
- →What does a static analyzer do?
- →How do you read a static-analysis report as a non-developer?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://rekt.news/wormhole-rekt/
- https://blog.chainalysis.com/reports/wormhole-hack-february-2022/
- https://github.com/crytic/slither
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The Wormhole loss is reported at about 325 million dollars, the value of 120,000 wrapped ether at the time. The precise sequence by which the attacker identified the vulnerability is partly inferred; the committed-but-undeployed fix in the public repository is documented.
Static analysis would not necessarily have caught Wormhole's specific bug automatically, and this lesson does not claim it would; it teaches that the flaw was a recognized class of pattern that such tools surface, and that a report is read for the questions it raises, not as a safety verdict.