Curriculum·G204 Tools a Non-Developer Can Run·about 30 min
Static analysis output a user can read
By the end of this lesson you can
- →Explain what a static analyzer does: flag classes of known-dangerous patterns in code without running it
- →Explain how the Wormhole bridge lost about 326 million dollars to a deprecated verification function whose fix was already public
- →Compute what a static-analysis report's severity buckets and categories tell a reader who cannot read the code itself
- →Read a static-analysis report for the questions it raises rather than as a verdict, and know its false-positive limits
Graduate · enrolled learners
This lesson opens with Wormhole bridge, 2 February 2022.
- What happened
- Wormhole is a bridge connecting Solana and Ethereum. Its Solana contract verified that a set of trusted guardians had signed off on a transfer, but the check used a deprecated function to load the verifying instruction and failed to confirm that the verification had actually been performed by the real system program. That let the attacker supply a spoofed set of signatures, pass the broken check, and mint 120,000 wrapped ether on Solana, about 326 million dollars, with nothing backing it. Code that closed exactly this weakness had been pushed to Wormhole's public code repository about nine hours before the attack, inside a pull request to update the Solana dependency, but had not yet been deployed to the live contract, and the attacker struck the still-vulnerable deployment. The flaw was a known-dangerous pattern, an unverified account in a security-critical path, of the class automated tools are built to flag, and the correction to it was public, though undeployed, before the loss.
- The decision point
- Wormhole's flaw was not exotic. Using a deprecated function and failing to verify an account in a signature check is a recognized category of mistake, the kind a static analyzer exists to raise, and code that fixed it was sitting in the open repository, undeployed, hours before the attack. The user's tool here is static analysis: automated scanners that read code and flag classes of known-dangerous patterns without running it, producing a report of findings sorted by severity and category. A non-developer cannot judge every finding, but they can read the report's shape, whether the security-critical categories are clean, whether high-severity items are present and addressed, and they can ask whether a flagged pattern was fixed and deployed or, as at Wormhole, merely fixed in public and left live. The report raises the questions; it does not answer them, and reading it that way is the skill.
- Recorded loss
- $326,000,000
What you will be able to answer
- →What flaw did the Wormhole exploit rely on?
- →What was notable about the Wormhole fix?
- →What does a static analyzer do?
- →How do you read a static-analysis report as a non-developer?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://rekt.news/wormhole-rekt
- https://www.chainalysis.com/blog/wormhole-hack-february-2022/
- https://github.com/crytic/slither
- https://ethereum.org/developers/docs/smart-contracts/testing/
- https://www.bleepingcomputer.com/news/security/wormhole-restores-stolen-326-million-after-major-crypto-bailout/
- https://www.halborn.com/blog/post/explained-the-wormhole-hack-february-2022
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
Rekt and Halborn put the Wormhole loss at 326 million dollars, the value of 120,000 wrapped ether at the time; Chainalysis says over 320 million. Halborn names the deprecated function, load_instruction_at, which did not check that the account supplied was the real Instructions sysvar. BleepingComputer reports that the correcting code was pushed about nine hours before the hack, in a pull request titled as a Solana version update that had been open since 13 January, and that it was likely not a deliberate security patch; that the attacker found the flaw by watching the repository is a researcher's suspicion, not an established fact.
Static analysis would not necessarily have caught Wormhole's specific bug automatically, and this lesson does not claim it would; it teaches that the flaw was a recognized class of pattern that such tools surface, and that a report is read for the questions it raises, not as a safety verdict.